Ransomware Series: SystemBC-Style SOCKS5 Proxy Persistence and C2 Beaconing

Ibrahim Saud@tektrix

•updated Sep 25, 2026•1•0•5

Detects processes establishing persistence via Windows Registry 'Run' keys followed by frequent outbound network connections over non-standard ports. This behavior is consistent with the SystemBC/Coroxy SOCKS5 proxy backdoor often utilized by ransomware actors like Ryuk, Conti, BlackBasta, Play, and Rhysida.