Malware hunters at SentinelOne on Thursday flagged a newly discovered Python-based hacking tool being used by cybercriminals to hijack cloud platforms and payment services.
The tool, called FBot, is capable of credential harvesting for spamming attacks, AWS account hijacking and functions to enable attacks against PayPal and various SaaS accounts.
According to documentation from the company's SentinelLabs research unit, Fbot is characterized by a smaller footprint compared to similar tools, indicating possible private development and a more targeted distribution approach.
SentinelLabs researcher Alex Delamotte dissected the internals of the attack tool and found features to target web servers and cloud services as well as Software-as-a-Service technologies that include Aws, Office365, PayPal, Sendgrid and Twilio.
While the tool is primarily designed for actors to hijack cloud, SaaS, and web services, Delamotte discovered a secondary focus on obtaining accounts to conduct spamming attacks.
The anti-malware company also discovered several features that target payment services, including a PayPal Validator feature, a SendGrid API key generator, and features for harvesting key secrets.
Delamotte recommends that organizations enable multi-factor authentication for AWS services with programmatic access and set up systems to alert security operations teams when a new AWS user account is added to the organization.
The researcher also suggests setting up alerts for new identities added or major configuration changes to SaaS bulk mailing applications.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 11 Jan 2024 21:13:05 +0000