SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers

SystemBC is a C-based malware that turns infected computers into SOCKS5 proxies, enabling communication with a C2 server and delivery of additional payloads. A proxy network named REM Proxy, powered by SystemBC, is said to offer about 80% of the botnet’s capacity and markets a pool of 20,000 Mikrotik routers, along with various open proxies found online.

According to Black Lotus Labs team at Lumen Technologies, the SystemBC botnet comprises over 80 C2 servers and a daily average of 1,500 victims, with nearly 80% of these compromised VPS systems from several large providers; 300 of the victims are part of another botnet called GoBruteforcer. The researchers note that the majority of compromises have long infection lifespans, with close to 40% lasting over 31 days, and each victim typically having 20 unpatched CVEs and at least one critical CVE on average.

One VPS in Atlanta was identified as vulnerable to more than 160 unpatched CVEs. The end goal appears to be to sell harvested credentials and enable widespread malicious activity via the proxy network.