SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation

Security researchers discovered a SystemBC C2 server linked to The Gentlemen ransomware group that reveals 1,570+ compromised corporate networks globally.

• •SystemBC establishes SOCKS5 network tunnels using custom RC4-encrypted protocol and can download additional malware or inject payloads directly into memory
• •The Gentlemen ransomware-as-a-service (RaaS) operation emerged in July 2025 and claims over 320 victims with double-extortion model
• •Threat actors gain initial access via internet-facing services or compromised credentials, then perform lateral movement, GPO abuse, and defense evasion
• •Recent Q1 2026 data shows 2,059 ransomware incidents with attack dwell times collapsing from days to hours

This summary was automatically generated by AI based on the original article and may not be fully accurate.