Connect with us

Hi, what are you looking for?



Floki Bot Developer Imports Cybercrime Tools to Brazil

Cisco Talos and Flashpoint have teamed up to conduct an in-depth analysis of Floki Bot, a Zeus-based banking Trojan that has been sold on cybercrime marketplaces since September 2016.

Cisco Talos and Flashpoint have teamed up to conduct an in-depth analysis of Floki Bot, a Zeus-based banking Trojan that has been sold on cybercrime marketplaces since September 2016.

Floki Bot, offered by its developers for $1,000 worth of bitcoins, is based on the Zeus source code that was leaked in 2011. However, researchers determined that the malware includes some new capabilities, including anti-detection features. Talos also spotted new code that allows the Trojan to use the Tor network, but the functionality is currently not active.

Flashpoint analysts believe that “flokibot,” the online moniker used by the threat actor behind the Floki Bot malware, is based in Brazil. Researchers determined that the actor communicates in Portuguese, it targets Brazilian IPs and domains, and it’s mainly interested in devices with the default language set to Portuguese. The actor appears to be most active on underground forums during hours within Brazil’s UTC -3 timezone.

Flashpoint has named the flokibot actor a “connector”, as they are present on several major underground communities outside of Brazil, particularly Russian- and English-speaking dark web communities.

Researchers believe that through their presence on these foreign websites, the cybercriminals import knowledge and tools into the Brazilian community.

“While Brazilian cybercriminals are not typically as technically sophisticated as their Russian counterparts, they will often solicit new forms of malware (to include point of sale [PoS] ransomware and banking Trojans), or offer their own services,” Vitali Kremez, senior intelligence analyst at Flashpoint, said in a blog post. “It appears that a presence on Russian [Deep and Dark Web] communities may be a likely factor in flokibot’s progression.”

In addition to the banking Trojan functionality borrowed from Zeus, researchers noticed that Floki Bot includes hooking methods designed to capture payment card data from memory. In one campaign analyzed by Flashpoint, 225 Floki bots appeared to have collected a total of 1,375 card dumps.

Advertisement. Scroll to continue reading.

“For connectors like flokibot, reaching across language barriers into predominantly English- and Russian-language communities enables them to to advance criminal schemes through new markets: it is not particularly difficult or expensive for botnet newcomers in short time to build their own botnets leveraging Floki Bot and start attacking corporate networks,” Kremez said.

Talos has published a detailed analysis of how Floki Bot works and released a tool designed to make it easier for analysts to examine the malware.

Related Reading: Fully Operational TrickBot Banking Trojan Targets UK, Australia

Related Reading: Dyre Authors Apparently Working on New Banking Trojan

Related Reading: Version 3 of Qadars Trojan Targets UK Banks

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...