flocker

Executive Summary

Flocker, also linked to the FSociety brand, is a ransomware-as-a-service (RaaS) group identified since April 2024. The group primarily targets Windows and Linux systems through phishing, compromised RDP connections, and exploit kits, employing a double extortion model. Collaborating with FunkSec, Flocker has demonstrated medium sophistication, focusing on financial gain and organizational disruption.

Goals & Targeting

Flocker's primary objectives revolve around financial gain through ransomware operations. The group targets organizations across multiple sectors, particularly those with weaker cybersecurity measures or high data sensitivity. Their victims include healthcare, finance, and educational institutions. The choice of targets suggests a focus on maximizing impact while minimizing detection risk.

Flocker is a ransomware-as-a-service (RaaS) group emerged in late 2023–2024 and operates under the FSociety brand. The threat actor targets Windows and Linux systems using a combination of phishing campaigns, compromised Remote Desktop Protocol (RDP) access, and exploit kits. Flocker employs a double extortion model, where victims are threatened with data encryption and subsequent leakages if demands are not met. This group is notable for its collaboration with FunkSec, enhancing its operational capabilities and attack vectors.

Key Capabilities

• Ransomware distribution via phishing campaigns
• Exploitation using exploit kits
• Compromised RDP access for initial breach
• Double extortion tactics
• Collaboration with other threat groups (e.g., FunkSec)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Flocker's campaign patterns include a focus on stealing sensitive data and encrypting systems, often followed by demands for cryptocurrency payments. The group has been active since April 2024, with operations observed in collaboration with FunkSec. Notable victims number 59 to date, primarily across sectors with high data value. Their operational tempo is moderate but persistent.

IOC Patterns

• Spear-phishing via email attachments
• Malicious scripts execution (e.g., PowerShell)
• C2 communications over Caddy-based platforms or custom tools
• RDP brute-force attempts

Recommended Actions

• Implement strict RDP access controls and multi-factor authentication.
• Monitor for suspicious script executions in IT environments.
• Encrypt sensitive data at rest with strong encryption standards.
• Enhance email filtering to detect phishing campaigns.
• Conduct regular security audits and patch management.

Suggested Tags