---
title: DroxiDat Targets African Power Company
description: Secure List recently reported on an African energy sector entity that was targeted using DroxiDat, a variant of SystemBC.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [DroxiDat Targets African Power Company](https://blog.polyswarm.io/droxidat-targets-african-power-company)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Aug 18, 2023 6:54:28 PM

**Related Families:** SystemBC  
**Verticals Targeted:** Energy

## **Executive Summary**

## An African energy sector entity was recently targeted using DroxiDat, a variant of SystemBC.

**Key Takeaways**

- DroxiDat was recently used to target an energy sector entity in Africa.
- DroxiDat is a more compact variant of SystemBC, with some of the previous functionality stripped away.
- The threat actors responsible for the attack also used Cobalt Strike beacons in conjunction with DroxiDat, indicating a high likelihood of planned follow-on attacks. 
- This attack has been tentatively attributed to the Fin12 threat actor group.

What is DroxiDat?

An African power company was recently targeted using DroxiDat, a variant of SystemBC. Secure List recently [reported](https://securelist.com/focus-on-droxidat-systembc/110302/) on DroxiDat.

SystemBC, active since at least 2018, is both a proxy and a RAT. It leverages SOCKS5. It is best known for being used in the DarkSide ransomware attack on Colonial Pipeline in 2021. SystemBC has been known to distribute other payloads, including Smokeloader and Emotet.

DroxiDat is more compact than previous SystemBC variants, as much of the functionality has been stripped. DroxiDat does not have the download and execute capabilities of previous SystemBC variants. The changes make DroxiDat more of a system profiler. The threat actors also used Cobalt Strike beacons in conjunction with DroxiDat in the attack, indicating a high likelihood of planned follow-on attacks. 

**Who is Fin12?**

Secure List tentatively points to Fin12 as the possible threat actor behind these attacks. Fin12, also known as Pistachio Tempest, typically targets healthcare entities rather than energy sector entities. However, they have been observed deploying SystemBC in conjunction with Cobalt Strike beacons.

Fin12 has been active since at least 2018 and is known to be financially motivated. Industry researchers believe group members primarily speak Russian, although the group’s nexus is unknown. They typically only target entities with a high stream of revenue. Their TTPs include but are not limited to the use of code-signed payloads, Ryuk, Trickbot, BazarLoader, Empire, and Cobalt Strike. While healthcare entities are their most frequent targets, Fin12 has also been observed targeting the education, manufacturing, technology, and financial verticals. 

**IOCs**

PolySwarm has a sample of DroxiDat.

 

[a00ca18431363b32ca20bf2da33a2e2704ca40b0c56064656432afd18a62824e](https://polyswarm.network/scan/results/file/a00ca18431363b32ca20bf2da33a2e2704ca40b0c56064656432afd18a62824e)

 

You can use the following CLI command to search for all DroxiDat samples in our portal:

**$ polyswarm link list -f DroxiDat**

 

***Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

 

[View full post](https://blog.polyswarm.io/droxidat-targets-african-power-company)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2023-08-25T17:09:18.700Z",
  "datePublished" : "2023-08-18T18:54:28Z",
  "headline" : "DroxiDat Targets African Power Company",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/DROXIDAT.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/droxidat-targets-african-power-company",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```