New SystemBC RAT Attack Linux Systems to Hack Corporate Infrastructure

A new variant of the SystemBC Remote Access Trojan (RAT) has emerged, explicitly targeting Linux-based systems. Known for its stealth capabilities, this malware is designed to infiltrate corporate networks, cloud servers, and IoT devices, posing a significant threat to internal corporate services and overall cybersecurity.

SystemBC, which has historically been a tool for Windows environments, now extends its reach with a Linux implant, providing attackers with a formidable tool for lateral movement and pivoting within a victim’s infrastructure.

This allows cybercriminals to navigate through networks without deploying additional tools that might be detected, thereby evading host-based security measures more effectively.

According to recent ANY.RUN Sandbox analyses, this new strain of SystemBC is particularly dangerous due to its ability to maintain encrypted communication with Command and Control (C2) servers using a custom protocol ensuring connection to a unified infrastructure of both Windows and Linux implants.

This ensures a unified infrastructure attack capability across both Windows and Linux platforms. Security experts have noted that this version does not have clear family detection by traditional security vendors, making it harder to identify and mitigate.

For those on the front lines of cybersecurity defense, the Linux version of SystemBC can be analyzed and detected using advanced tools like ANYRUN’s Linux Virtual Machine.

Here, security professionals can leverage in-depth network traffic analysis powered by expert-crafted Suricata rules to identify malicious activities.

IOCs (Indicators of Compromise) have been identified, including domain names and hash values associated with this malware:

• Domain: cluster[.]amazonaws[.]work
• Hashes: 0e1b714ff0ea13e64b302c48cb12c9bf, 3d544d6b9086da758f17149cf1ac2e81, 8601c30e1c5ba28541c8b164a879bfcb, a1cc04b62c048cdbb25d027ab5dea111

Decrypted Traffic and Configuration:

Linux traffic and configuration can be examined using CyberChef recipes provided by analysts, showing how data is encrypted and communicated back to C2 servers.

Several samples of this malware have been analyzed in interactive sandboxes like ANYRUN, providing insights into its behavior and network interactions. This real-time analysis helps in understanding the malware’s tactics, techniques, and procedures (TTPs).

Cybersecurity teams are urged to incorporate these new insights into their threat intelligence platforms. With the ability to search for specific threat signatures and behaviors, organizations can improve the precision and efficiency of their security responses.

As the digital landscape continues to evolve, so do the threats within it. The emergence of this SystemBC Linux variant underscores the need for constant vigilance, updated security practices, and the adoption of advanced analytical tools to stay ahead of malicious actors.

Organizations are encouraged to analyze latest malware and phishing threats using platforms like ANYRUN to fortify their defenses against such sophisticated attacks.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN Sandox -> Try for Free