Attackers increasingly do not attack you from their own machines. They rent someone else’s. In September 2025, researchers at Lumen’s Black Lotus Labs reported that the SystemBC botnet was compromising an average of about 1,500 servers a day, most of them commercial virtual private servers (VPS), and reselling them as proxies that hide the true origin of criminal traffic.
For defenders, this has two consequences. Traffic from a clean-looking cloud IP address is no longer evidence that the traffic is legitimate. And any VPS your organization runs, whether a marketing site, a test box or a forgotten development server, can quietly become part of someone else’s attack infrastructure. This article explains how proxy botnets like SystemBC work, why they defeat common defenses, and what to do on both sides of the problem.
What SystemBC is and how it evolved
SystemBC has been around since at least 2019. It began as a proxy and backdoor tool favored by ransomware operators: once inside a victim network, they used it to tunnel their command-and-control (C2) traffic through a SOCKS5 proxy so it blended in and survived the loss of other footholds. It appeared in intrusions linked to several major ransomware families, and it was one of the malware loaders targeted by the international Operation Endgame takedown in May 2024.
What Black Lotus Labs documented in 2025 is a change in business model. SystemBC has become a proxy supply chain. Its operators infect servers at scale, then rent the resulting pool of IP addresses to other criminal services. The largest customer identified was REM Proxy, a commercial proxy service that relies on SystemBC for a large share of its inventory. Other customers included Russian-linked proxy services, a Vietnamese proxy service and a web-scraping operation, and SystemBC’s own operators used the network to brute-force WordPress logins.
Why VPS servers are the target
Most proxy botnets are built from home routers and IoT devices. SystemBC’s pool is different: nearly 80 percent of its victims were VPS instances at large commercial hosting providers. That choice is deliberate.
- Bandwidth and uptime. A VPS has a fast, always-on connection, so it can carry far more traffic than a home router.
- Neglect. Researchers found victims had on average around 20 unpatched vulnerabilities each, with at least one rated critical. Many servers are spun up for a project and never maintained.
- Longevity. Because nobody is watching, infections persist. Around 40 percent of compromised systems stayed infected for more than a month.
- Reputation. Traffic from a mainstream hosting provider looks ordinary to most filters, unlike traffic from known malicious hosting.
The botnet was managed through more than 80 C2 servers, and some victims overlapped with other brute-forcing botnets, a reminder that a poorly maintained server is rarely compromised only once.
How proxy botnets are used against you
Proxy networks are infrastructure, not a single attack. They make many other attacks cheaper and harder to stop. Three uses matter most to a typical organization.
Hiding command-and-control traffic. Malware on a compromised laptop can check in with its operator through a proxy on a hosting provider’s IP range. Blocklists built around known attacker infrastructure miss it, and the real C2 server stays hidden behind layers of rented hops.
Distributed brute-force and credential stuffing. An attacker testing stolen passwords against your VPN, Microsoft 365 tenant or WordPress admin page can spread attempts across thousands of IP addresses. Each address makes only a few attempts, staying under per-IP rate limits and lockout thresholds.
Laundering attribution. Scraping, fraud and reconnaissance all look like they come from ordinary cloud customers. Investigators and threat intelligence feeds struggle to pin activity to an actor, and blocking whole hosting ranges would also block legitimate customers and partners.
The same infrastructure logic drives DDoS-for-hire services such as the one described in Next-Gen DDoS-as-a-Service: ShadowV2. Criminals increasingly buy capacity rather than build it.
What to do: defending against and not becoming a proxy
There are two jobs here. The first is to stop relying on IP reputation to decide what is trustworthy. The second is to make sure your own servers are not part of the pool.
- Inventory every server you run in the cloud. Include marketing sites, staging environments and anything a contractor built. Assign an owner to each one or shut it down. Unowned servers are the ones that end up in botnets.
- Patch and harden internet-facing VPS instances. Apply security updates automatically, disable password authentication for SSH in favor of keys, close unused ports, and keep web applications and plugins current. An average of 20 open vulnerabilities per victim tells you where the problem is.
- Watch your servers’ outbound traffic. A web server that suddenly makes connections to many unrelated destinations, or runs an unfamiliar process listening on a high port, may be proxying for someone else. Cloud flow logs and basic egress rules catch this.
- Use phishing-resistant MFA and smart lockout on logins. Distributed brute force defeats per-IP limits, but not strong authentication. Enforce MFA on VPNs, email and admin panels, and prefer account-level anomaly detection over IP blocklists.
- Run EDR on endpoints and servers. Endpoint detection and response can spot SystemBC and similar malware by behavior, such as unexpected SOCKS proxy activity or persistence mechanisms, even when network indicators change.
- Treat threat intelligence as one signal. Feeds that track proxy and C2 infrastructure are useful, but proxy IPs rotate quickly. Combine them with network traffic analysis and behavioral detection rather than relying on blocklists alone.
The trade-off is that behavior-based detection takes tuning and someone to review alerts, while IP blocking is easy. But blocking by IP now gives a false sense of security. If you host customer data or regulated workloads on cloud servers, a compromised VPS is also a compliance problem; our cybersecurity and compliance services cover server hardening and monitoring as part of that picture. For how attackers use stolen and stuffed credentials once they get through, see Credential and Identity Theft Is Reaching Crisis Levels.
Frequently asked questions
How would we know if one of our servers is part of a proxy botnet?
Common signs include unexplained outbound connections to many destinations, higher-than-expected bandwidth bills, unfamiliar processes or scheduled tasks, and abuse complaints from your hosting provider. Reviewing cloud flow logs and running an EDR agent on the server are the most reliable ways to confirm it.
Can we just block traffic from hosting providers?
For some services, such as an internal admin portal, restricting access to known IPs or a VPN is reasonable. For customer-facing services it usually is not, because legitimate users, partners and integrations also come from cloud ranges. Strong authentication and behavioral detection are more durable.
Is SystemBC still linked to ransomware?
It began as a tool used in ransomware intrusions to maintain covert access, and finding it on a network should be treated as a serious incident. Its newer role as a commercial proxy network means an infected server may be serving many different criminal customers at once.
Keeping your infrastructure out of the botnet
Delana Technologies helps organizations inventory and harden cloud servers, monitor outbound traffic, and move authentication away from IP-based trust toward controls that hold up against distributed attacks. To review your internet-facing infrastructure, call 239.414.5126 or contact us.
Sources: Lumen Black Lotus Labs, SystemBC research (September 2025); The Hacker News, “SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers” (September 2025); BleepingComputer, “SystemBC malware turns infected VPS systems into proxy highway” (September 2025); Europol announcement on Operation Endgame (May 2024).