Check Point Links 1,570-Host SystemBC Botnet to Gentlemen Ransomware Affiliate
Summary
Check Point researchers linked a SystemBC botnet of more than 1,570 hosts to a Gentlemen ransomware affiliate, detailing its use for covert payload delivery and an attack chain involving Cobalt Strike, Mimikatz and GPO-based deployment.
Key points
- Check Point researchers linked a SystemBC command-and-control server with telemetry from more than 1,570 infected hosts to a Gentlemen ransomware affiliate; they said the victims likely included many organizations.
- The affiliate attempted to use SystemBC for covert payload delivery, but researchers could not determine whether multiple affiliates used the malware.
- The initial access method was unknown. Researchers said the attacker operated from a Domain Controller with Domain Admin privileges and deployed Cobalt Strike to remote systems via RPC.
- Mimikatz credential harvesting and remote execution supported lateral movement; Group Policy helped trigger near-simultaneous ransomware execution across domain-joined systems.
- The ransomware uses X25519 and XChaCha20; it fully encrypts files under 1 MB and encrypts selected chunks of larger files.
- Before encryption, the malware terminates database, backup and virtualization processes and deletes Shadow copies and logs; its ESXi variant shuts down virtual machines.
- Check Point provided indicators of compromise and a YARA rule to help defenders detect the activity.
Article Details
- Attack Vectors
- The initial access vector in the observed attacks was not determined.
- A Gentlemen affiliate operated from a Domain Controller with Domain Admin privileges, checked credentials, and conducted reconnaissance.
- The affiliate deployed Cobalt Strike payloads to remote systems via RPC and used Mimikatz for credential harvesting and remote execution.
- The attackers staged ransomware from an internal server and used Group Policy (GPO) to trigger execution across domain-joined systems.
- SystemBC was used for SOCKS5 tunneling and covert payload delivery; Check Point identified a botnet of more than 1,570 infected hosts associated with a Gentlemen affiliate.
- Defensive Notes
- Check Point provided indicators of compromise and a YARA rule to help defenders detect the attacks.
- The researchers report that Gentlemen terminates databases, backup software, and virtualization processes and deletes Shadow copies and logs before encryption.
MITRE ATT&CK
T1003 · OS Credential DumpingThe affiliate used Mimikatz to harvest credentials; the article does not specify the credential-dumping method.T1021 · Remote ServicesThe affiliate deployed Cobalt Strike payloads to remote systems via RPC and used remote execution for lateral movement.T1090 · ProxySystemBC provided SOCKS5 tunneling and was used by a Gentlemen affiliate for covert payload delivery.T1484.001 · Group Policy ModificationThe attackers used Group Policy to trigger near-simultaneous ransomware execution across domain-joined systems.T1486 · Data Encrypted for ImpactGentlemen ransomware encrypted files, fully encrypting files under 1 MB and encrypting selected chunks of larger files.T1489 · Service StopBefore encryption, Gentlemen ransomware terminates database, backup, and virtualization processes; its ESXi variant also shuts down VMs.T1490 · Inhibit System RecoveryBefore encryption, Gentlemen ransomware deletes Shadow copies and terminates backup software.
Threat Actors
Malware
Gentlemen ransomwareCheck Point researchers uncovered a SystemBC botnet of more than 1,570 infected hosts tied to a Gentlemen ransomware affiliate that used the proxy for covert payload delivery.SystemBCCheck Point researchers uncovered a SystemBC botnet of more than 1,570 infected hosts tied to a Gentlemen ransomware affiliate that used the proxy for covert payload delivery.
Products
Tools
Cobalt Strikemidâ2025 with Go and C lockers (including an ESXi variant), employs a humanâoperated toolkit—Cobalt Strike, Mimikatz and GPO propagation—and a hybrid X25519/XChaCha20 encryption scheme.Mimikatzwith Go and C lockers (including an ESXi variant), employs a humanâoperated toolkit—Cobalt Strike, Mimikatz and GPO propagation—and a hybrid X25519/XChaCha20 encryption scheme.
Countries
AustraliaVictims are mainly in the US, UK, Germany, Australia and Romania, and Check Point released IoCs and a YARA rule to aid defenders.GermanyVictims are mainly in the US, UK, Germany, Australia and Romania, and Check Point released IoCs and a YARA rule to aid defenders.RomaniaVictims are mainly in the US, UK, Germany, Australia and Romania, and Check Point released IoCs and a YARA rule to aid defenders.United KingdomAccording to Check Point, most of the victims linked to Gentlemen’s deployment of SystemBC are located in the United States, the United Kingdom, Germany, Australia, and Romania.United StatesVictims are mainly in the US, UK, Germany, Australia and Romania, and Check Point released IoCs and a YARA rule to aid defenders.