# The Gentlemen Ransomware Gang Builds Hidden Army: 1,570+ Victims Found Connected to Proxy Malware Network
Security researchers have uncovered a sprawling botnet operation tied to The Gentlemen, a notorious ransomware-as-a-service (RaaS) collective, revealing how the criminal organization deploys specialized proxy malware to maintain hidden access to compromised networks. The discovery by Check Point researchers exposed a command-and-control (C2) infrastructure managing over 1,570 infected systems—a window into the operational complexity behind one of the ransomware ecosystem's most active extortion campaigns.
## The Threat Landscape
The discovery highlights an alarming trend in modern ransomware operations: threat actors are moving beyond single-stage attacks to build multi-layered infrastructures that maximize their operational resilience and control duration. The Gentlemen, which has emerged as one of the more prolific ransomware-as-a-service platforms, demonstrates how established criminal enterprises combine publicly available tools with custom malware to establish persistent access before launching encryption attacks.
The malware in question, SystemBC, is a known proxy tool that has circulated in underground forums for several years. Rather than being a novel creation, The Gentlemen's adoption of SystemBC underscores how ransomware operations leverage existing malware components as force multipliers—reducing development costs while expanding operational capabilities.
## Background and Context
The Gentlemen ransomware operation has maintained a consistent presence in the threat landscape, targeting organizations across healthcare, manufacturing, finance, and critical infrastructure sectors. Like most modern RaaS platforms, the operation follows a distributed model where affiliates purchase access to the malware distribution network and operational infrastructure, with profits split between the core operators and the attackers who conduct actual intrusions.
SystemBC's role in this ecosystem is crucial: rather than serving as the primary extortion payload, the proxy malware acts as a persistent backdoor. This layered approach allows The Gentlemen's operators to:
Check Point's research traced the C2 infrastructure to a specific server configuration, which led to the identification of the 1,570+ victim machines connected through the proxy network. This infrastructure discovery represents a rare opportunity for defenders to understand the scale and scope of an active ransomware operation's victim base.
## Technical Details
SystemBC functions as a SOCKS5 proxy server, a protocol that allows the malware to tunnel traffic through compromised endpoints. This technical approach provides several operational advantages for threat actors:
| Technical Capability | Purpose |
|---|---|
| SOCKS5 Protocol Implementation | Enables encrypted traffic tunneling and anonymization |
| Port Isolation | Routes traffic through non-standard ports to evade detection |
| Multi-hop Capabilities | Chains compromised hosts to obscure attacker source IP |
| Persistent C2 Communication | Maintains callback channels independent of initial access method |
The proxy malware establishes persistent tunnels within victim networks, allowing threat actors to navigate through protected network segments without direct internet connectivity. This means that even organizations with robust perimeter security can remain vulnerable if endpoint-level protections fail to detect SystemBC installations.
The infection vector typically begins with initial access breaches—phishing campaigns, unpatched vulnerabilities, or compromised credentials. Once SystemBC is installed, the victim network becomes part of a larger proxy network, creating what amounts to a private VPN infrastructure for the attackers. Each infected machine becomes a potential pivot point for lateral movement.
The C2 server discovery is significant because it allowed researchers to map the operational scope without requiring infiltration of The Gentlemen's primary infrastructure. This suggests the proxy network may have been inadequately protected or discovered during routine malware analysis work.
## Implications for Defenders
The scale of the discovery—over 1,570 victims—underscores several critical security gaps:
The presence of 1,570 connected victims indicates that many organizations remain vulnerable to proxy malware installation despite years of publicly available information about SystemBC. This gap between known threats and actual compromise rates reflects broader challenges in threat remediation:
For the victims connected to this C2 infrastructure, the discovery presents both risk and opportunity. While the exposure is concerning, the takedown or neutralization of this specific C2 infrastructure could disrupt The Gentlemen's ability to coordinate certain operations.
## Operational Patterns in Modern Ransomware
The Gentlemen's use of proxy malware reflects a maturation in ransomware operations—moving away from rapid spray-and-pray infection models toward slower, more deliberate compromise chains. This pattern suggests:
This patient, methodical approach has proven more effective than aggressive, rapid encryption campaigns. By maintaining hidden proxy access for weeks or months, threat actors can identify the most valuable targets, establish stable command channels, and prepare comprehensive data exfiltration operations.
## Recommendations
Organizations should prioritize several defensive actions:
Immediate priorities include network traffic analysis to identify potential SOCKS5 proxy connections and behavioral monitoring for SystemBC's known process and registry signatures. Endpoint detection and response (EDR) tools should flag suspicious proxy implementations and unusual inter-process communication patterns.
Medium-term strategies involve reducing the initial access surface through credential hygiene, multi-factor authentication, and aggressive patching of known vulnerabilities. Network segmentation can limit the lateral movement potential of proxy malware if infection occurs.
Long-term approaches should emphasize threat hunting for SystemBC variants and related tools, regular tabletop exercises for ransomware scenarios, and coordination with security researchers to understand evolving malware deployment patterns.
## HackWire Analysis
The discovery of The Gentlemen's proxy botnet reveals an uncomfortable reality: even well-known malware tools remain effective because many organizations have yet to implement the detection capabilities that would identify them. The 1,570 victims likely represent only a fraction of total historical infections; many organizations remain unaware of compromises that may not have progressed to encryption. As ransomware operations become more sophisticated and patient, the traditional approach of rapid detection and response must evolve toward continuous network monitoring and threat hunting for persistent access mechanisms that precede encryption attacks.