Ankura CTIX FLASH Update - August 15, 2023

Ransomware/Malware Activity

New Malware Variant Used to Target Southern African Power Company

A new variant of the SystemBC malware called DroxiDat has been used in an attempted cyberattack against the electrical infrastructure of Southern Africa. In March 2023, the attack began by using DroxiDat to get profiles of the computer systems in use, and then proxying network traffic using the SOCKS5 protocol to place a command-and-control (C2) infrastructure between the network and outside traffic. SystemBC is a C/C++ based malware that first appeared in 2019 with the ability to set up SOCKS5 proxies on victim machines in order to tunnel malicious traffic and malware. This falls in line with previous uses of SystemBC, having been used in the past to initiate ransomware attacks. This is not the case for DroxiDat, however, which has had much of its original functionality removed in favor of a slimmer design that only exfiltrates system profiles to a remote server. The