SystemBC Botnet Evolves Into High-Volume VPS Proxy Network, Powering Criminal Ecosystem

The Black Lotus Labs team at Lumen Technologies has revealed that the SystemBC botnet has grown into a high-volume VPS proxy network powering a criminal ecosystem, now comprising more than 80 command-and-control servers and a daily average of 1,500 victims, with nearly 80% of those victims being compromised VPS systems from large commercial providers. According to the researchers, the victims are made into proxies that enable high volumes of malicious traffic for use by a host of criminal threat groups.

The latest findings show a shift from hijacking residential IP space to exploiting virtual private servers, providing large bandwidth and longer infection lifespans, with close to 40% of VPS victims staying infected for well over a month. One primary user of the network is REM Proxy, which offers roughly 80% of the SystemBC pool to its customers; REM Proxy itself is linked to ransomware groups and markets access to 20,000 Mikrotik routers, open proxies, and SystemBC victims.

Black Lotus Labs noted that both Linux and Windows variants exist, and that some samples decrypt their C2 configurations before establishing proxies. In response, Lumen Technologies has blocked all traffic across its global network associated with SystemBC and REM Proxy, and IoCs have been released to aid defenders.