SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks

Gbhackers •Mayura Kathir • June 30, 2026

SystemBC (also tracked as Coroxy) remains a versatile and persistent Windows malware family that operators routinely deploy to convert compromised hosts into SOCKS5 proxy gateways and to maintain remote access for follow-on operations. First observed as a payload in exploit kits around 2018–2019, SystemBC has evolved into a widely traded commodity tool used by multiple […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SystemBC Malware Turns Compromised Windows Machines Into Ransomware Proxies SystemBC malware, also known as Coroxy, is being utilized by threat actors to convert Windows machines into SOCKS5 proxy gateways. This malware allows attackers to maintain persistent access and route malicious traffic through compromised systems. It has been linked to several high-profile ransomware operations since its emergence around 2018-2019. Security researchers have observed its increasing prevalence across enterprise networks, indicating a growing threat landscape. The malware's ability to hide command and control (C2) traffic makes it particularly dangerous. Organizations using Windows systems are at risk, as the malware targets these environments to facilitate further attacks. The current status of SystemBC highlights its evolution into a widely traded tool among cybercriminals, emphasizing the need for enhanced security measures. 2 sources 67

Extracted Entities

SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)