How do you defend a business when the very infrastructure meant to carry your traffic has been turned into a fleet of malicious proxies? That question is no longer hypothetical: investigators uncovered a SystemBC proxy malware botnet of more than 1,570 hosts after probing a Gentlemen ransomware incident, and those hosts are believed to be corporate victims.
What investigators found
An investigation into a Gentlemen ransomware attack carried out by a gang affiliate revealed a large-scale SystemBC proxy malware botnet. The botnet comprises in excess of 1,570 hosts and is believed to consist of corporate victims whose systems have been co-opted to run proxy services for the malware.
Why the discovery matters
At a minimum, the finding changes the calculus for responders and defenders. A proxy botnet of this size can mask command-and-control traffic, relay malicious connections, and complicate attribution and containment efforts. That complexity raises the cost and difficulty of incident response and heightens the risk that initial intrusions will spread or blend into legitimate network activity.
Perspectives and implications
- Technologists: Network defenders and security teams face a longer tail for clean-up when corporate machines serve as proxies. Tools that rely on endpoint isolation or straightforward traffic-blocking may be less effective if malware traffic is relayed through widely distributed corporate hosts.
- Policymakers: The presence of large proxy botnets built from corporate systems underscores the need for policies and incentives that improve threat visibility, incident reporting, and cooperative mitigation across sectors—especially when criminal affiliates leverage third-party infrastructure.
- Users and organizations: Companies whose systems are unknowingly enlisted into a botnet confront reputational, operational, and legal risks. Even absent direct extortion, being part of a proxy network can expose an organization to liability and downstream abuse.
- Adversaries: For criminal operators, a sizable proxy layer offers operational advantages—greater obfuscation and resilience. For affiliates working with ransomware gangs, such resources can increase the scale and stealth of attacks.
What to watch next
The discovery ties a significant proxy-capable botnet to a specific ransomware incident, emphasizing how criminal ecosystems leverage compromised corporate infrastructure. The details reported—more than 1,570 hosts, use of SystemBC, and linkage to a Gentlemen ransomware affiliate—are concrete indicators that defenders should treat similar traffic patterns and post-compromise proxy activity as high-priority signals. As organizations and authorities respond, the central question remains: will detection and coordination outpace the adversary's ability to repurpose legitimate systems into weapons?
Read the original report: https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/
