This week, Tanium’s Cyber Threat Intelligence (CTI) team investigates SystemBC, a large-scale proxy botnet that’s leveraging compromised virtual private server (VPS) infrastructure to support cybercriminal operations, including ransomware and credential theft. Next, the team looks at ShinyHunters—a financially motivated data extortion group that’s now targeting enterprise cloud applications.
Also included is an overview of a sophisticated phishing campaign that used AI-generated code to obfuscate malicious payloads within SVG files, aiming to bypass traditional detection methods.
SystemBC botnet targets VPS infrastructure
The Black Lotus Labs team at Lumen Technologies is sharing new details about the SystemBC botnet, including its vast reach, persistent infections, and integration with multiple threat actor services.
The SystemBC botnet has been active for years, infecting thousands of systems daily. Notably, it favors VPS infrastructure—accounting for the majority of its victims—to maximize bandwidth and persistence, according to Black Lotus Labs.
Like other botnets, these victims turn into proxies for malicious traffic. According to Black Lotus Labs, SystemBC uses VPS systems as opposed to residential IPs to “offer proxies with massive amounts of volume for longer periods of time.”
Researchers have observed these proxies being used by several networks. One of the main users of the botnet is a proxy network called REM Proxy. This network has been linked to ransomware actors over the past few years and offers three different packages to its users, with the top tier supposedly having low detection rates. The report contains a deeper dive into REM Proxy for those interested.
While an initial access vector could not be identified, Black Lotus Labs discovered that each victim showed roughly 20 unpatched CVEs with one or more being critical.
Global telemetry and victim analysis
Actors using this proxy network will start by engaging C2 IP addresses that belong to SystemBC. This will funnel the user to one of the victims in the botnet. Telemetry shows SystemBC maintains around 1,500 active bots daily, with 80% concentrated across five major VPS providers. This concentration contributes to long infection durations, with nearly 40% of systems remaining compromised for over a month.
No specific targeting pattern was observed among VPS providers. However, Black Lotus Labs determined that most contained vulnerabilities that were easy to exploit. The researchers linked many attacks to a single IP address that appears to recruit victims.
Proxy analysis
The operators and customers of the SystemBC botnet don’t appear to care as much about evasion and stealth, based on the fact that the IP addresses are not rotated or obfuscated. The botnet prioritizes volume.
Most of the botnet’s users are operators that use the network to brute force WordPress credentials, potentially to sell for a profit. The botnet also serves a large Russian web scraping service, a Vietnamese-based VN5Socks proxy service, and REM Proxy.
Analyst comments from Tanium’s Cyber Threat Intelligence team
As Black Lotus Labs points out, SystemBC has been resilient for years and has become a “persistent vector within the cyber threat landscape.”
SystemBC’s use of compromised VPS infrastructure marks a shift in botnet strategy, favoring stability and bandwidth over stealth. This makes it harder to detect, but potentially easier to track once identified.
The persistence of infections and lack of IP rotation suggest either operational negligence or a calculated trade-off, where threat actors prioritize throughput and accessibility over evasion, betting on the slow response of defenders.
ShinyHunters targets enterprise cloud applications
According to EclecticIQ, the ShinyHunters group is increasingly targeting enterprise cloud applications to steal sensitive data and pressure victims into paying ransoms. ShinyHunters now combines tactics like AI voice phishing, supply chain attacks, and malicious insiders to conduct their attacks.
ShinyHunters first emerged in 2020 and is active on Telegram and English-speaking cybercriminal forums. EclecticIQ has identified what they believe are three of the most active members of the group in 2025, noting that these members have loose ties to other groups like Scattered Spider, The Com, and Lapsus$.
One member, Yukari, is believed to be a member of both ShinyHunters and Scattered Spider. EclecticIQ believes this member is responsible for the initial compromise, SIM swapping attacks, and voice phishing. The leader of ShinyHunters, ShinyCorp, likely recruits via eCrime actors. In general, it seems as though ShinyHunters members often work across multiple groups.
AI voice agents and a Scattered Spider affiliate network
ShinyHunters has used VoIP based calling services to conduct vishing and AI-powered voice call platforms to automate social engineering calls. For example, the group uses Bland AI to “dynamically adjust their narratives and tactics in real time, tailoring responses to victim’s reactions during phone calls.” The attacker can change the voice style to sound more human, and the model adjusts its tone and responses to enhance legitimacy.
According to the ShinyHunters leader, the voice call portion of the attacks are carried out by members of Scattered Spider, though some members used The Com. ShinyHunters is actively seeking out recruits for voice call phishing via Telegram groups.
Vishing attacks against cloud application users
EclecticIQ believes that the group also carried out vishing attacks to compromise Salesforce applications, impersonating IT staff and tricking victims into entering connection codes and authorizing applications controlled by the actor. In 2025, ShinyHunters has also been observed impersonating Okta SSO login pages to steal credentials.
ShinyHunters is believed to have stolen BrowserStack API keys to target enterprise development environments. EclecticIQ also suspects that the group targeted Cloudflare Zero Trust resources.
Recruiting insiders
At the end of August, a Telegram channel called “scattered LAPSUS$ hunters 4.0” shared a recruiting message looking for insiders at organizations that would provide access to systems like Okta, Microsoft SSO, Citrix VPN, and GitHub. The post offered financial rewards in exchange for access.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Misconfigured cloud services and poor identity hygiene have become low-hanging fruit for threat actors, signaling that cloud environments must be treated with the same rigor as traditional infrastructure.
The group’s reliance on stolen credentials underscores the importance of robust identity protection strategies, including MFA, conditional access policies, and continuous monitoring and highlights how identity is the new perimeter.
If nothing else, ShinyHunters reminds us that enterprise SaaS is a high-value target.
Phishing campaign uses AI-generated code to avoid detection
Microsoft recently uncovered a sophisticated phishing campaign that used AI-generated code to obfuscate malicious payloads within SVG files to bypass traditional detection methods.
Despite the advanced tactics, Microsoft's AI-powered security systems successfully identified and blocked the threat by analyzing behavioral and contextual signals.
Phishing campaign tactics and payload
In August, Microsoft identified a phishing campaign that used a compromised email account to deliver phishing messages to steal credentials. The attacker behind the campaign used a self-addressed email tactic so that the sender and recipient addresses appeared to be the same, hiding the true targets of the message in the BCC field.
The body of the phishing email instructed the recipient that a file had been shared with them and contained a supposed attachment of that file. The attached file was named “23mb – PDF- 6 pages.svg,” an SVG file labeled to trick victims into thinking it was a PDF. Opening this file redirects the victim to a page with a fake CAPTCHA prompt for stealing credentials.
Microsoft analyzed the SVG code to reveal its obfuscation methods. The code was designed to look like a business analytics dashboard with chart bars and month labels. However, these were set to zero opacity and transparent fill, rendering them invisible. The true functionality of the payload was also hidden with the help of business tools.
Microsoft determined the goal was to redirect users to a phishing landing page, fingerprint the browser, and initiate session tracking.
Using AI to analyze the campaign
Microsoft believes the attacker may have used AI to help obfuscate the payload functionality. To confirm this theory, they asked Copilot to analyze the file and determine if it was created by AI.
Copilot returned that it was highly likely that the code was synthetic and generated by either an LLM or a tool that uses one. Copilot specifically returned five pieces of evidence to support this, including:
- Overly descript and redundant naming of function and variable names
- Modular and over-engineered code structure
- Generic comments
- Formulaic obfuscation techniques
- Unusual use of CDATA and XML declaration
Analyst comments from Tanium’s Cyber Threat Intelligence team
AI-generated obfuscation marks a turning point in phishing sophistication. Attackers are no longer just mimicking human behavior, but leveraging machine intelligence to create code that’s harder to detect and reverse-engineer.
The use of business jargon as a camouflage for malicious code is particularly clever, exploiting trust in professional language to bypass heuristic filters and human suspicion.
Microsoft’s successful detection highlights the importance of behavior-based analysis over static code inspection, especially as AI-generated threats become more context-aware. Microsoft has also shared recommendations, Defender detections, and hunting queries to help identify this threat.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.