SystemBC Botnet Compromises 1,500 VPS Every Day to Rent Out for DDoS Attacks

SystemBC, a resilient SOCKS5 malware network first spotted in 2019, has evolved its proxy infrastructure to compromise an average of 1,500 virtual private servers (VPS) each day, shifting from residential devices to high‑capacity VPS nodes for broader bandwidth and longer-lasting malicious traffic. According to Black Lotus Labs at Lumen Technologies, more than 80 command-and-control servers fuel the botnet, nearly 80 percent of which use commercial VPS providers.

The network’s VPS proxies enable gigabyte‑scale data transfers that can persist without triggering typical host or provider alarms, supporting sustained DDoS and brute‑force operations. Victim servers commonly exhibit an average of twenty unpatched vulnerabilities, with some systems harbouring more than 160 CVEs, and attackers often probe port 443 for initial access while using port 80 callbacks to download multiple shell scripts.

REM Proxy emerges as a prominent user, renting about 80 percent of the SystemBC network and aggregating 20,000 compromised MikroTik routers and open proxies, with Morpheus and AvosLocker ransomware groups leveraging the service for various attack needs. Lumen Technologies has null-routed known SystemBC and REM Proxy infrastructure to disrupt the operation, while defenders are urged to monitor VPS IP ranges and verify cloud servers’ security postures.