Ankura CTIX FLASH Update - January 12, 2024

Ransomware/Malware Activity

Python Malware Fbot Targets Cloud Services

A new malware targeting web servers and cloud services has been revealed by researchers at Sentinel Labs. This new malware, dubbed Fbot, is written in Python and has been seen targeting a variety of cloud services and other software as a service (SaaS) providers including Amazon Web Services, Office365, Sendgrid, and Twilio. Although Fbot's primary purpose appears to be hijacking these services, it also maintains secondary capabilities to gather account credentials for any number of purposes. The control panel for the malware comes with twenty-three (23) pre-installed functions for the user to choose from. These include options to try and brute force AWS access keys, add new accounts to AWS Simple Email Service with elevated privileges, and check an AWS EC2 service's configurations and allotted resources. Fbot can also determine any emails associated with PayPal accounts, run reverse IP scans