Coroxy Malware — Analysis, Campaigns & Threat Activity

Related Threat Clusters

• New PoC Exploit for NTLM Reflection Bypass Vulnerability on Windows Server

  A proof-of-concept (PoC) exploit has been released for a NTLM reflection bypass vulnerability, tracked as CVE-2026-24294, which allows attackers to gain SYSTEM-level access on Windows Server 2025. This vulnerability…

  3 articles · Updated June 30, 2026
• SystemBC Malware Turns Compromised Windows Machines Into Ransomware Proxies

  SystemBC malware, also known as Coroxy, is being utilized by threat actors to convert Windows machines into SOCKS5 proxy gateways. This malware allows attackers to maintain persistent access and route malicious traffic…

  2 articles · Updated June 30, 2026
• Over 10,000 Linux Servers Infected by SystemBC Botnet Variant

  A new Linux variant of the SystemBC remote access trojan has infected over 10,000 IP addresses worldwide, primarily targeting web servers. Discovered by Silent Push, the compromised servers include those hosting…

  6 articles · Updated February 4, 2026

Recent Intelligence Reports

• PoC Released for NTLM reflection bypass Vulnerability that Emanbles SYSTEM Access on ... — Gbhackers · June 30, 2026
• SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks — Gbhackers · June 30, 2026
• Over 10,000 SystemBC Botnet Infections Identified Globally — Technadu · February 4, 2026

Related Entities