MITRE ATT&CKsoftware (malware)
S9001 SystemBC
- Domain
- enterprise
- Platforms
- Linux, Windows
- Aliases
- Coroxy
- Version
- 1.0
- Created
- 2025-12-15
Description
SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. SystemBC was first detected in 2018, and has been used by Wizard Spider since at least 2020, and by FIN7 since at least 2022.
Related
Uses · MITRE ATT&CK (21)
- T1678 Delay Execution technique
- T1620 Reflective Code Loading technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.004 DNS sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1571 Non-Standard Port technique
- T1564.003 Hidden Window sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1087.001 Local Account sub-technique
- T1053.005 Scheduled Task sub-technique
- T1480 Execution Guardrails technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1001 Data Obfuscation technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
- T1124 System Time Discovery technique
References
- https://asec.ahnlab.com/en/33600/ AhnLab_SystemBC_Apr2022
- https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ BlackBasta
- https://blog.lumen.com/systembc-bringing-the-noise/ Lumen_SystemBC_Sept2025
- https://www.broadcom.com/support/security-center/protection-bulletin/systembc-coroxy-continuous-activities Broadcom_SystemBCCoroxy_Nov2023
- https://news.sophos.com/en-us/2020/12/16/systembc/ SophosGnGal_SystemBC_Dec2020
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Coroxy.A&ThreatID=2147766831 Microsoft_Coroxy_Oct2020
- https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server TrumanKroll_SYSTEMBCServer_Jan2024