Researchers at Sophos noticed recently that the operators of multiple ransomware families have been using a backdoor named SystemBC, which provides attackers a connection to compromised devices and which uses the Tor anonymity network to hide command and control (C&C) communications.
Initially observed in 2019, SystemBC enables persistent access to the system, providing attackers with means to conceal communications and remotely control the infected devices.
Designed with support for the execution of commands and to allow adversaries to download and execute scripts, executables, and DLLs, the backdoor is continuously evolving, with recent samples having switched from creating a SOCKS5 proxy to using the Tor network for communication purposes.
Over the past months, Sophos researchers identified hundreds of attacks employing SystemBC, some of them being recent Ryuk and Egregor ransomware assaults, in which the backdoor was deployed in combination with other post-exploitation tools, including Cobalt Strike.
In some instances, the backdoor was deployed after the attackers were able to compromise administrative accounts and moved deep into the network.
For persistence, the malware copies itself to a folder in the ProgramData directory and schedules the copy as a task that is launched using the ‘start’ command, as a scheduled service. It searchers for a process associated with Emsisoft’s anti-malware software and skips the creation of the service if the process is found.
Most of the communication with the C&C server is per ..
Support the originator by clicking the read the rest link below.
