A new malware targeting web servers and cloud services has been revealed by researchers at Sentinel Labs. This new malware, dubbed Fbot, is written in Python and has been seen targeting a variety of cloud services and other software as a service (SaaS) providers including Amazon Web Services, Office365, Sendgrid, and Twilio. Although Fbot’s primary purpose appears to be hijacking these services, it also maintains secondary capabilities to gather account credentials for any number of purposes. The control panel for the malware comes with twenty-three (23) pre-installed functions for the user to choose from. These include options to try and brute force AWS access keys, add new accounts to AWS Simple Email Service with elevated privileges, and check an AWS EC2 service’s configurations and allotted resources. Fbot can also determine any emails associated with PayPal accounts, run reverse IP scans while in its environment, capture credential information from Laravel files on websites, and find a list of phones numbers associated with a Twilio account. With samples date back to July 2022 with the newest samples being from January 2024, Fbot has managed to stay under the radar for quite some time, possibly due to the fact that it appears to be a more personalized tool than other similar pieces of malware like AlienFox or Greenbot and it is not being distributed on known crimeware channels or forums. CTIX analysts will continue to monitor the evolution of custom-tailored cloud targeting malware.