Droxidat

DroxiDat, a new variant of the SystemBC malware, was deployed in a series of attacks on critical infrastructure targets in Africa during the third and fourth weeks of March. The malware, which acts as a system profiler and simple SOCKS5-capable bot, was specifically detected at an electric utility company in southern Africa. Researchers from Kaspersky's Global Research and Analysis Team (GReAT) identified an unknown threat actor behind these attacks. This particular DroxiDat variant is more compact compared to previous SystemBC variants, displaying its adaptability to attackers' needs. The incident appears to be part of a broader wave of attacks involving both DroxiDat and Cobalt Strike beacons, tools used to remotely control compromised devices. These were found in the same systems as DroxiDat, pointing towards a coordinated attack strategy. The researchers also observed that the hackers used the Cobalt Strike tool along with DroxiDat to profile compromised systems and establish remote connections on the electric utility. Interestingly, several incidents involving Cobalt Strike shared the same license ID, staging directories, and/or C2. Given the nature of the malware and the pattern of the attacks, it is believed that this could have been the initial stage of a ransomware attack. In a similar healthcare-related incident around the same time, Nokoyawa ransomware was delivered alongside DroxiDat. As such, there is a significant concern that this wave of attacks using DroxiDat might escalate into more severe cybersecurity threats, including potential data breaches and ransom demands.