SystemBC infections now exceed 10,000 IPs globally, including systems linked to government hosting.

Silent Push also uncovered a stealthy Linux-targeting Perl variant with zero AV detections.

https://www.technadu.com/systembc-infections-exceed-10000-including-systems-linked-to-government-hosting/619549/

Thoughts?
#ThreatIntel #Malware #SystemBC #Ransomware

A single infected VPS is now pumping out 16GB of proxy traffic a day—turning servers into a cybercrime highway. How is SystemBC reshaping the threat landscape? Read on to uncover the full story.

https://thedefendopsdiaries.com/systembc-malware-transforming-infected-vps-systems-into-a-proxy-highway/

#systembc
#malware
#vpssecurity
#botnet
#cybercrime
#proxy
#infosec
#threatintelligence
#cybersecurity

Another day, another #Amadey 📅👀 This time dropping #SystemBC ⤵️

Amadey botnet C2:
📡cobolrationumelawrtewarms .com
📡107.189.27.66 (AS14956 ROUTERHOSTING 🇳🇱)

Dropping SystemBC from the following URL:
🌐https://urlhaus.abuse.ch/url/3470633/

SystemBC payload:
📄https://bazaar.abuse.ch/sample/c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131/

SystemBC botnet C2:
📡towerbingobongoboom .com
📡213.209.150.137:4086 (AS42821 RAPIDNET 🇩🇪)

Happy Monday, or should I say, Happy #DFIRDay!

That's right, The DFIR Report has dropped another one of their awesome reports, this time covering an attack that involved the #BlackSuit ransomware. There was a dash of #CobaltStrike, #SystemBC, some encoded Powershell commands for defense evasion (and to keep you guessing on what the command really is!), LSASS access for credentials, and ultimately led to the ransomware being deployed. This report provides a great example of all the things the adversary needs to do to be successful in an attack and all the information they need from your environment to do it!

Stay tuned for your Threat Hunting Tip of the Day but while you wait, enjoy the article! Happy Hunting!

And I promise you I am not going to take the easy way out and hit you with the AutoRun registry key hunt package again!

BlackSuit Ransomware
https://thedfirreport.com/2024/08/26/blacksuit-ransomware/

Cyborg Security Intel 471 #CyberSecurity #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Debellate dall'Europol tutte le botnet ramsonware. Operation Endgame, la più grande operazione della storia contro le botnet. Operazione Endgame è un'operazione internazionale delle forze dell'ordine che mira a combattere le botnet e i loro utilizzatori.
Tra il 27 e il 29 maggio 2024 è stata messa in atto un'operazione internazionale di contrasto al crimine...

#botnet #Bumblebee #Europol #hackers #IcedID #OperationEndgame #Pikabot #Ransomware #SmokeLoader #SystemBC

https://scienzamagia.eu/misteri-ufo/debellate-dalleuropol-tutte-le-botnet-ramsonware/