SystemBC Botnet Hijacked 10,000 Devices Worldwide to Use for DDoS Attacks

Executive summary: The report details the SystemBC botnet — a resilient backconnect/SOCKS5 malware infrastructure controlling over 10,000 compromised systems worldwide (notably ~4,300 in the U.S.) that persists for weeks to months and is used as a precursor to ransomware and other criminal operations. Silent Push researchers identified a previously undocumented Perl variant (initially undetected by AV) deployed via UPX-packed ELF droppers (“SafeObject” and “StringHash”) that search writable directories and launch many embedded payloads; the infrastructure has adapted post-law-enforcement takedowns by shifting focus toward hosting providers, increasing persistence and operational utility. Organizations are advised to prioritize proactive monitoring for these indicators and backconnect activity to prevent escalation to data theft or ransomware.