New SystemBC Malware Variant Targets South African Power Company

An unfamiliar threat actor has been linked to a cyber attack on a power technology business in South Africa with a new variant of the SystemBC malware termed DroxiDat as a precursor to a suspected ransomware attack.

“The proxy-capable backdoor was deployed alongside Cobalt Strike Beacons in a South African nation’s critical infrastructure,” Kurt Baumgartner, principal security researcher at Kaspersky’s Worldwide Investigate and Evaluation Crew (Great), stated.

The Russian cybersecurity organization explained the attack, which took location in late March 2023, was in its early levels and concerned the use of DroxiDat to profile the process and proxy network targeted traffic using the SOCKS5 protocol to and from command-and-regulate (C2) infrastructure.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

SystemBC is a C/C++-based mostly commodity malware and remote administrative device that was initial noticed in 2019. Its major feature is to set up SOCKS5 proxies on victim computer systems that can then be utilized by threat actors to tunnel malicious visitors related with other malware. Newer variants of the malware can also download and operate additional payloads.

The use of SystemBC as a conduit for ransomware attacks has been documented in the past. In December 2020, Sophos discovered ransomware operators’ reliance on SystemBC RAT as an off-the-shelf Tor backdoor for Ryuk and Egregor bacterial infections.

“SystemBC is an interesting resource in these types of operations due to the fact it makes it possible for for a number of targets to be labored at the same time with automatic jobs, allowing for for hands-off deployment of ransomware using Windows constructed-in applications if the attackers attain the good qualifications,” the firm said at the time.

DroxiDat’s one-way links to ransomware deployment stem from a healthcare-related incident involving DroxiDat all over the similar timeframe in which the Nokoyawa ransomware is stated to have been sent along with Cobalt Strike.

The malware used in the attack is both compact and lean when when compared to SystemBC, stripped off most of the performance affiliated with the latter to act as a straightforward process profiler and exfiltrate the details to a remote server.

“It presents no down load-and-execute abilities, but can link with distant listeners and move info back again and forth, and modify the procedure registry,” Baumgartner explained.

The id of the danger actors guiding the wave of attacks is at the moment unidentified, while existing evidence factors to the very likely involvement of Russian ransomware teams, particularly FIN12 (aka Pistachio Tempest), which is recognised to deploy SystemBC together with Cobalt Strike Beacons to deploy ransomware.

The progress will come as the range of ransomware attacks focusing on industrial companies and infrastructure has doubled because the second quarter of 2022, jumping from 125 in Q2 2022 to 253 in Q2 2023, according to Dragos. The figure is also an 18% improve from the former quarter, when 214 incidents had been determined.

“Ransomware will continue on to disrupt industrial functions, irrespective of whether by way of the integration of operational technology (OT) destroy procedures into ransomware strains, flattened networks making it possible for ransomware to unfold into OT environments, or precautionary shutdowns of generation by operators to avert ransomware from spreading to industrial control methods,” the business assessed with large self-confidence.

Located this write-up appealing? Stick to us on Twitter  and LinkedIn to go through far more special written content we article.