Loading malware…
FBot is a Python-based cloud and web attack tool associated with credential harvesting, account takeover, and abuse of cloud and SaaS services for follow-on operations such as spam enablement. It targets exposed web applications, web servers, and online services including AWS, Office365, PayPal, Sendgrid, Twilio, and other platforms where leaked configuration files or exposed secrets can be monetized. The tool has also been referenced separately in IoT botnet reporting, indicating that the name has been used in more than one malware context.
In its cloud-focused form, FBot includes modules for scanning websites for exposed configuration data, validating accounts, and checking stolen credentials against service APIs. Documented functionality includes searching for exposed environment and configuration files, extracting credentials and service tokens, validating PayPal accounts, checking Twilio account details, generating Sendgrid-like API keys, and interacting with AWS services to inspect quotas and create a new privileged IAM user on compromised accounts. These behaviors indicate a strong emphasis on credential theft, post-compromise cloud abuse, and persistence within victim cloud environments.
FBot has been observed targeting technologies and platforms commonly exposed on internet-facing infrastructure, including Laravel and other PHP-based applications, as well as CMS and web application stacks such as Drupal, Magento, WordPress, Joomla, Zimbra, Moodle, OpenCart, phpBB, and MediaWiki. Its operators appear to use it to harvest secrets from misconfigured or exposed systems rather than relying solely on endpoint malware deployment. One version was compiled as a Windows executable, but the malware is primarily characterized as a Python tool used against cloud and web services.
FBot has also appeared in botnet-related reporting involving exploitation of vulnerable IoT devices, including propagation via a LILIN DVR vulnerability chain, and it has been cited as an ancestor or code influence in later botnet families such as Dysphoria. Separately, Rapper Bot reporting stated that its code derived in part from fBot alongside Mirai and Tsunami. These references suggest that the FBot name has been associated with both cloud-focused offensive tooling and botnet lineage, but the best-supported and most distinctive characterization is the Python-based cloud account hijacking tool.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
FBot has three functions dedicated to AWS account attacks. The first is an AWS API Key Generator, handled by function aws_generator, which generates a random AWS access key ID by appending 16 randomly selected alphabetic characters to the standard AKIA prefix. Then, it generates a secret key from 40 randomly selected alphabetic characters.
The second AWS feature is a Mass AWS Checker, handled by function aws_checker. This function checks for AWS Simple Email Service (SES) email configuration details, including the maximum send quota and rate, as well as how many messages have been sent in the past 24 hours, likely to maximize spamming efforts against the targeted account.
The Hidden Config Scanner feature takes a URL as input and crafts an HTTP GET request to several PHP, Laravel, and AWS-related URIs where configuration values may be stored, including: _profiler/phpinfo config.js .env config/aws.yml .env.bak info.php aws.yml phpinfo aws/credentials phpinfo.php
The second AWS feature is a Mass AWS Checker, handled by function aws_checker. This function checks for AWS Simple Email Service (SES) email configuration details, including the maximum send quota and rate, as well as how many messages have been sent in the past 24 hours, likely to maximize spamming efforts against the targeted account.
The second AWS feature is a Mass AWS Checker, handled by function aws_checker. This function checks for AWS Simple Email Service (SES) email configuration details, including the maximum send quota and rate, as well as how many messages have been sent in the past 24 hours, likely to maximize spamming efforts against the targeted account.
The second AWS feature is a Mass AWS Checker, handled by function aws_checker. This function checks for AWS Simple Email Service (SES) email configuration details, including the maximum send quota and rate, as well as how many messages have been sent in the past 24 hours, likely to maximize spamming efforts against the targeted account.
The response is parsed for keys and secrets related to the following services and the result is written to a text file: AWS ... Office365 ... Sendgrid ... Twilio ... Mailgun | FBot is primarily designed for actors to hijack cloud, SaaS, and web services. There is a secondary focus on obtaining accounts to conduct spamming attacks. Actors can use the credential harvesting features to obtain initial access, which they can sell to other parties.
The tool contains assorted utilities, including an IP address generator and port scanner.
The function cms_scanner contains a map of CMS and web frameworks to regular expressions (regex) associated with the service. The program creates a request to the targeted URL and parses the response for the following technologies: Codeigniter Laravel phpBB ... WordPress ... Joomla ... Zimbra
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A precursor malware/botnet family from which Dysphoria evolved.
Referenced as a Dysphoria variant/base whose communication protocol and DDoS functionality were further customized by Dysphoria.
Python-based cloud attack tool designed to hijack cloud, SaaS, and web service accounts. It harvests credentials, scans for exposed configuration files, validates accounts for services like PayPal, checks AWS SES and EC2 details, creates privileged AWS IAM users on compromised accounts, and supports spam-enablement activities.
A cloud attack tool that validates PayPal accounts using requests to an external website; the same validator is also used by Legion Stealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.