DroxiDat Malware Deployed in Suspected Ransomware Attack

A cyber attack on a power generation company in southern Africa has been attributed to an unidentified threat actor. This attack involved the utilization of a new version of the SystemBC malware named DroxiDat, which served as a preliminary step to a suspected ransomware attack.

Security researchers reported that the attack took place in late March 2023. The malicious activity was still in its early stages at that time. The attack strategy involved using DroxiDat to profile the targeted system and direct network traffic through SOCKS5 proxies to and from the command-and-control (C2) infrastructure. This was done alongside the deployment of Cobalt Strike Beacons in the critical infrastructure of a nation in southern Africa.

DroxiDat Builds Upon Older SystemBC Malware

SystemBC is a type of malware and remote administrative tool coded in C/C++, initially detected in 2019. It is designed to establish SOCKS5 proxies on compromised computers, which can then be utilized by threat actors to tunnel malicious traffic related to other forms of malware. Advanced iterations of SystemBC can also download and execute additional malicious payloads.

Past instances have shown that SystemBC has been used as a conduit for ransomware attacks. In December 2020, Sophos revealed that ransomware operators relied on the SystemBC Remote Access Trojan (RAT) as a readily available Tor backdoor for Ryuk and Egregor infections.

DroxiDat, on the other hand, has connections to ransomware deployment. An incident in the healthcare sector involving DroxiDat occurred around the same time period when Nokoyawa ransomware was delivered in conjunction with Cobalt Strike.

The malware employed in this particular attack is more compact and streamlined compared to SystemBC. It lacks many of the features found in SystemBC and is primarily used to profile the targeted system and send the acquired information to a remote server. Unlike SystemBC, DroxiDat does not possess the ability to download and execute additional code, but it can establish connections with remote listeners and exchange data, as well as make modifications to the system registry.

Although the identity of the threat actors remains unknown, available evidence suggests the possible involvement of Russian ransomware groups, specifically FIN12 (also known as Pistachio Tempest). This group is recognized for using SystemBC in conjunction with Cobalt Strike Beacons for deploying ransomware attacks.