Malware hunters at SentinelOne on Thursday flagged a newly discovered Python-based hacking tool being used by cybercriminals to hijack cloud platforms and payment services.
The tool, called FBot, is capable of credential harvesting for spamming attacks, AWS account hijacking and functions to enable attacks against PayPal and various SaaS accounts.
According to documentation from the company’s SentinelLabs research unit, Fbot is characterized by a smaller footprint compared to similar tools, indicating possible private development and a more targeted distribution approach.
SentinelLabs researcher Alex Delamotte dissected the internals of the attack tool and found features to target web servers and cloud services as well as Software-as-a-Service (SaaS) technologies that include Aws, Office365, PayPal, Sendgrid and Twilio.
While the tool is primarily designed for actors to hijack cloud, SaaS, and web services, Delamotte discovered a secondary focus on obtaining accounts to conduct spamming attacks.
“The tool contains assorted utilities, including an IP address generator and port scanner. There is also an email validator function, which uses an Indonesian technology service provider to validate email addresses,” the SentinelLabs researcher said.
The anti-malware company also discovered several features that target payment services, including a PayPal Validator feature, a SendGrid API key generator, and features for harvesting key secrets.
Delamotte recommends that organizations enable multi-factor authentication (MFA) for AWS services with programmatic access and set up systems to alert security operations teams when a new AWS user account is added to the organization.
The researcher also suggests setting up alerts for new identities added or major configuration changes to SaaS bulk mailing applications.
Related: New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
Related: US Gov Warning: Start Hunting for Iranian APTs That Exploited Log4j
Related: Researchers Crowdsourcing Effort to ID Mysterious Metador APT
Related: Urgent Fixes for Critical Flaws in Windows Kerberos, Hyper-V
