FLOCKER Ransomware Affiliate Program Reappears With 90% Share and Claimed Cross-Platform Tools

Summary

A post attributed to “greens6699” advertises FLOCKER ransomware affiliate recruitment, offering a 90% revenue share and claimed Windows, Linux and macOS tooling. The capabilities and services have not been independently verified.

Key points

• A supplied screenshot shows an account using the handle “greens6699” advertising that the FLOCKER affiliate program has returned after a period of inactivity.
• The offer promises affiliates 90% of proceeds, charges a one-time $170 invitation fee and claims operators will help obtain legitimate access.
• The advertisement claims tooling for Windows, Linux and macOS, including lockers for Windows and Linux and file-extraction and custom Bash-script capabilities for macOS.
• Advertised features include encryption, file extraction, stealth, selective targeting and customization; Windows features also include free-space wiping.
• The post describes a control panel for build configuration, analytics, customer support and affiliate rankings.
• The article says the advertised capabilities, payouts, services and operational status have not been independently verified; no malware samples or binaries were provided.

MITRE ATT&CK

Threat Actors

Malware

Products

Related Articles

• Compromised Jscrambler npm Releases Deliver Cross-Platform InfostealerLinux · macOS · Microsoft Windows
• Sophos Details GOLD SHERWOOD’s The Gentlemen Ransomware PlaybookLinux · Microsoft Windows · T1486
• JSCEAL Malware Spread Through Fake Cryptocurrency Exchange Ads on FacebookmacOS · Microsoft Windows
• Google Ads Deliver Fake Tech-Support Lockers Impersonating Microsoft Defender and ApplemacOS · Microsoft Windows
• Compromised HBO Max Reddit Account Exposed a Cross-Platform PasteSwitch ClickFix CampaignmacOS · Microsoft Windows