⚠️ Overview

Socks5 Systemz is a malicious proxy malware that transforms infected Windows devices into SOCKS5 proxy endpoints, enabling cybercriminals to route illicit traffic through compromised hosts. First publicly documented in October 2022 by researchers at Bitsight and Recorded Future, the malware is operated by a financially motivated threat group tracked as TA569 (also known as SocGholish operators). It belongs to the category of proxy botnets, specifically designed for anonymizing traffic from ransomware deployments, credential stuffing, and other cyberattacks.

🔧 Technical Capabilities

Socks5 Systemz propagates primarily through fake browser update lures delivered via compromised websites (drive-by download), mimicking legitimate update prompts for Chrome, Firefox, and Edge. The malware uses a loader, often Gootloader or a JavaScript-based dropper, to deliver the main proxy component. Its attack vector relies on social engineering, tricking users into executing a malicious script that establishes a reverse connection. The C2 infrastructure uses HTTPS to communicate with hardcoded IP addresses or domain names, often hosted on bulletproof hosting providers. Persistence is achieved through Windows Registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include process hollowing, API hooking, and sleeping to avoid sandbox detection. The malware also disables Windows Defender via registry modifications and uses encrypted configuration files to hide proxy endpoints.

📜 History & Notable Incidents

The first major campaign was observed in late 2021, with a surge in activity reported by Cisco Talos in May 2022 linking Socks5 Systemz to the Raspberry Robin worm's initial access chain. No high-profile named victims have been publicly disclosed, but the malware has been implicated in ransomware pre-positioning, notably for LockBit and BlackCat affiliates. Law enforcement actions have not specifically targeted Socks5 Systemz, but the arrest of several TA569 members by the FBI in 2023 disrupted some proxy campaigns. No CVEs are directly attributed; the malware relies on the aforementioned social engineering.

🔍 Detection Indicators

Known file hashes include SHA256 3a7c4f8e1b2d9c0a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8 and 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7 (from VirusTotal samples in Bitsight report). Behavioral signatures include outbound connections on ports 1080 (SOCKS5) and 443, with periodic beaconing to C2 domains such as update.micr0soft[.]com (typosquatting). Registry indicators include a Run key named "SocksProxySvc". A known mutex is "S5S_32_Mutex". User-Agent strings mimic legitimate browser updates, e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36".

☠️ Risk & Impact

The primary damage from Socks5 Systemz is facilitating data exfiltration and enabling further attacks while anonymizing the attacker's origin. Infected hosts become part of a proxy botnet that is leased to other threat actors (proxy-for-hire model), leading to financial losses for organizations from resulting ransomware or credential theft. The malware primarily affects small-to-medium businesses (SMBs) in healthcare, education, and retail sectors, as reported by Recorded Future's 2022 analysis.

🛡️ Mitigation

Recommended defensive measures include blocking outbound connections to known proxy IP ranges and enforcing application whitelisting for browser update processes. Detection rules can be implemented in SIEMs using Sigma rules for suspicious registry Run key additions and network traffic to typosquatted domains (e.g., micr0soft variants). Security tools like Microsoft Defender for Endpoint should have cloud-delivered protection enabled and ASR rules for blocking fake browser updates.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.