aol.pm

SystemBC

Software · ATTACK:enterprise:S9001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S9001",
  "title": "SystemBC",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--39643fb9-00c1-4a45-85e5-801a3f2665d1",
  "external_id": "S9001",
  "domain": "enterprise",
  "created": "2025-12-15T22:33:21.950Z",
  "modified": "2026-04-23T03:17:29.350Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Coroxy"
    },
    {
      "source_name": "AhnLab_SystemBC_Apr2022",
      "url": "https://asec.ahnlab.com/en/33600/"
    },
    {
      "source_name": "BlackBasta",
      "url": "https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/"
    },
    {
      "source_name": "Lumen_SystemBC_Sept2025",
      "url": "https://blog.lumen.com/systembc-bringing-the-noise/"
    },
    {
      "source_name": "Broadcom_SystemBCCoroxy_Nov2023",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletin/systembc-coroxy-continuous-activities"
    },
    {
      "source_name": "SophosGnGal_SystemBC_Dec2020",
      "url": "https://news.sophos.com/en-us/2020/12/16/systembc/"
    },
    {
      "source_name": "Microsoft_Coroxy_Oct2020",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Coroxy.A&ThreatID=2147766831"
    },
    {
      "source_name": "TrumanKroll_SYSTEMBCServer_Jan2024",
      "url": "https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02085573-6f4a-495f-b3a7-81ac97ce3377

SophosGnGal_SystemBC_Dec2020 · TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b98618a-fca0-49e4-b611-b93bf8f9cd1e

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14c87d77-834d-4f0a-abaa-984c7e2a67d6

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--179cb2c1-5069-479d-ab51-6e1adfd2d983

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17efbe51-6bd0-458f-98f3-f841b105d7bf

TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S9001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2209dcd4-debf-44f3-91f1-be904454e629

Microsoft Ransomware as a Service · Microsoft_PistachioTempest_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eb1f662-5901-4bbe-b45b-54c8dfc5e20e

SophosGnGal_SystemBC_Dec2020 · TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--355975ea-f7ae-4ae9-9b76-9a90c1b620c8

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441fa206-c1cf-40dd-850e-897adcf4776f

AhnLab_SystemBC_Apr2022 · Lumen_SystemBC_Sept2025

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4802a823-0a51-47c2-aabe-369a2430ba95

Lumen_SystemBC_Sept2025

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fac7323-462e-4ef5-848b-5ff54833a67e

HarmonProofpoint_SystemBC_Aug2019

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62bfecb7-7388-410a-afb3-fcd60fbc0af9

TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6375b66d-a3de-4f89-8cf2-c4f70fc46a8f

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670b59d4-25c6-4171-a36b-efb27155cc95

AhnLab_SystemBC_Apr2022 · SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67810ade-edd1-4d33-9677-b8bd8a175638

BlackBasta · SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019 · TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e823be-ab39-44c1-b56f-b371a2a0118b

SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--753c921d-31ab-4a92-8ff9-c1f0b04a13d5

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8befb9c9-cff9-472c-8fbb-561466a13944

TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9139c3d3-c466-4847-8b1b-257af487d5ef

SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95c85b70-64f6-410f-82fd-c9dc1c154a4f

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8c8c0bc-0240-4cd1-aff3-edbe19a91e57

AhnLab_SystemBC_Apr2022 · SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e083b35e-7f4b-4d4f-bb5b-0663e51256c6

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S9001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9bcda68-7633-4531-a7f2-e1b117d0e559

FortinetEtAl_IranianIntrusion_Mar2025

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S9001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f85d7fd3-e997-4a28-acd6-d5416346f051

BlackBasta

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.