BlueVoyant's research revealed a significant concern surrounding supply chain cyber incidents, with 98% of surveyed companies acknowledging the impact these incidents have on their operations. The increasing trend of outsourcing escalates the risk to sensitive data and operations due to cyber threats associated with third parties. Supply chain vulnerabilities can lead to severe damage or loss within minutes, highlighting the critical nature of monitoring and addressing such risks proactively. BlueVoyant's focus on managing external cyber risks aims to safeguard companies against these looming threats by offering specialized cybersecurity solutions.

SystemBC Malware: A Persistent Proxy and RAT Tool in Ransomware Attacks SystemBC, also known as Coroxy, is a long-standing Windows malware family first detected in exploit kits around 2018–2019. Initially a secondary payload, it has since evolved into a widely used commodity tool, frequently deployed alongside loaders like Buer, QBot, and Emotet. Its lightweight, modular design and dual functionality as both a SOCKS5 proxy and remote-access trojan (RAT) make it a favored component in ransomware operations, including those linked to Ryuk, Conti, Egregor, BlackBasta, Play, and Rhysida. The malware follows a predictable infection lifecycle: after initial access, it copies itself into a randomly named file under `%ProgramData%`, establishes persistence via a registry Run key and scheduled task, and employs anti-detection measures such as skipping installation if security software like Emsisoft’s a2guard.exe is detected. Some variants use in-memory droppers to unpack secondary binaries, either injecting them into processes or executing them from disk. SystemBC’s defining feature is its SOCKS5 proxy capability, which allows attackers to route command-and-control (C2) and exfiltration traffic through compromised hosts. Newer versions increasingly use Tor for anonymity, blending malicious traffic with legitimate enterprise flows to evade detection. Operators manage live SOCKS sessions via a control panel that supports auto-updates, authentication, and tens of thousands of simultaneous connections. Early versions relied on encrypted beacons (RC4-encrypted host/user data) for C2 communication, while newer builds shift traffic to Tor using embedded directory-authority IPs. The malware supports a range of payloads EXE, DLL, shellcode, VBS, BAT, CMD, and PowerShell many executed in memory to avoid disk writes. For threat actors, SystemBC is rarely the end goal but a force multiplier, enabling stealthy lateral movement and tool reuse across access-as-a-service chains. Its presence often signals broader compromise, including credential theft and further malware deployment. Defenders are advised to monitor unusual outbound SOCKS/Tor connections, suspicious scheduled tasks, and in-memory execution techniques, while network segmentation and egress filtering can limit its impact.