Flashpoint analysts monitoring a top-tier Russian hacking forum recently observed an actor who goes by the pseudonym “flokibot,” developing a Trojan known as “Floki Bot.” While the malware uses source code from the ZeuS Trojan, the actor reinvented the initial dropper process injection to instead target point-of-sale (PoS) terminals.

The Floki Bot Trojan is not only representative of the increasingly-collaborative nature of cybercrime, it also illustrates the growing presence of “connectors” within the Deep and Dark Web.