Upgraded Tool Used In Ryuk And Egregor Attacks

OXFORD, U.K.  — décembre 16, 2020 —

Sophos, a global leader in next-generation cybersecurity, today published new research into the SystemBC malware, “Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor.”  The research shows how SystemBC has developed into a fully-fledged remote access tool that acts as a Tor proxy and is being used in ransomware-as-a-service attacks for communications, data exfiltration and the download and execution of malicious modules.

SystemBC was first discovered in 2019, operating like a “virtual private network” via a SOCKS5 proxy. A year on, the upgraded version analysed by Sophos provides attackers with a persistent backdoor that automates a number of key activities so that operators can launch multiple attacks without the need for hands-on-keyboard activity. It can execute Windows commands passed over the Tor connection, as well as deliver and execute scripts, malicious executables and dynamic link libraries (DLLs).

Sophos’ research is based on investigations into recent ransomware-as-a-service attacks involving Ryuk and Egregor, which all deployed SystemBC. The investigations show that SystemBC is used in combination with different commodity tools, creating a diverse profile of tactics, techniques and procedures (TTPs). For instance, in some of the Ryuk attacks investigated SystemBC was deployed alongside Buer Loader malware, while other attacks in the same campaign used Bazar or Zloader. The Egregor attacks that Sophos investigated used SystemBC together with Qbot.

“We are increasingly seeing ransomware operators outsource the deployment of ransomware to affiliates using commodity malware and attack tools,” said Sean Gallagher, senior security researchers, Sophos. “SystemBC is a regular part of recent ransomware attackers’ toolkits— Sophos has detected hundreds of attempted SystemBC deployments worldwide over the last few months. The backdoor can be used in combination with other scripts and malware to perform discovery, exfiltration and lateral movement in an automated way across multiple targets. These SystemBC capabilities were originally intended for widespread commodity malware, but they have now been folded into the toolkit for targeted attacks—including ransomware.

“The use of multiple tools in ransomware-as-a-service attacks creates an ever more diverse attack profile that is harder for IT security teams to predict and deal with. Defense-in-depth, employee education and human-based threat hunting are essential to detecting and blocking such attacks.”

A list of IOCs for SystemBC is posted on SophosLabs’ GitHub page.

Further information on System BC and other cyberthreats can be found on SophosLabs Uncut where Sophos researchers regularly publish their latest research and breakthrough findings, such as Egregor Ransomware: Maze’s Heir Apparant and Inside a New Ryuk Ransomware Attack. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

À propos de Sophos

Sophos est un leader mondial innovant dans le domaine des solutions de sécurité avancées qui neutralisent les cyberattaques. La Société a fait l’acquisition de Secureworks en février 2025, réunissant ainsi deux pionniers qui ont redéfini l’industrie de la cybersécurité grâce à leurs services, technologies et produits innovants, optimisés par l’intelligence artificielle native. 
Sophos est désormais le plus grand fournisseur spécialisé de services de détection et réponse managées (MDR) protégeant plus de 28,000 organisations à travers et d’autres services, son portefeuille complet comprend les solutions de sécurité de pointe pour les endpoints, les réseaux, les emails et le cloud, qui interagissent et s’adaptent dynamiquement pour assurer une défense efficace via la plateforme Sophos Central.  
Secureworks apporte à cette alliance ses technologies innovantes et leaders sur le marché, notamment Taegis XDR/MDR, la détection et réponse aux menaces sur l’identité (ITDR), des capacités SIEM nouvelle génération, la gestion des risques ainsi qu’un ensemble complet de services de conseil en cybersécurité.  
Sophos commercialise l’ensemble de ces solutions à travers un réseau mondial de revendeurs, de fournisseurs de services managés (MSP) et de fournisseurs de services de sécurité managés (MSSP), protégeant plus de 600 000 entreprises contre le phishing, les ransomwares, le vol de données et d’autres cybermenaces, qu’elles soient quotidiennes ou menées par des Etats-nations.  
Toutes les solutions sont alimentées par des renseignements sur les menaces en temps réel et historiques issus de Sophos X-Ops et de la Counter Threat Unit (CTU) récemment intégrée.  
Le siège social de Sophos est situé à Oxford, au Royaume-Uni. Pour plus d’informations, consultez le site sophos.fr.