> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # FLOCKER Ransomware Affiliate Program Returns With 90% Revenue Share and Cross-Platform Tooling - URL: https://darkwebinformer.com/flocker-ransomware-affiliate-program-returns-with-90-revenue-share-and-cross-platform-tooling/ - Published: 2026-10-06T17:57:11.000Z - Updated: 2026-10-06T17:57:11.000Z - Author: Dark Web Informer - Tags: Ransomware Ransomware Affiliate Report Affiliate Recruitment Cross-Platform Locker 90% Revenue Share Observed ## FLOCKER Ransomware Affiliate Program Returns With 90% Revenue Share and Cross-Platform Tooling Affiliate share90% Invitation fee$170 Platforms3 listed LanguagesRust, Go Severity HIGH ### Overview An actor using the handle **"greens6699"** is advertising the **FLOCKER affiliate program** and says the operation has returned after a period of inactivity. The post offers affiliates **90% of proceeds** and states that operators will assist with obtaining legitimate access. The advertisement describes tooling for **Windows, Linux and macOS**, along with a control panel for build configuration, analytics, customer support and affiliate rankings. Advertised capabilities include file extraction, encryption, stealth features, exclusions and selective targeting, customization, shape-shifting functionality and, for Windows, free-space wiping and complete disk/data coverage. The post lists **Rust and Go** as development languages and requires a **$170 one-time invitation fee**. **The capabilities and operational claims have not been independently verified.** ### Post details ProgramFLOCKER ActivityRansomware affiliate recruitment Actor"greens6699" Affiliate share90% Invitation fee$170 one-time registration LanguagesRust, Go PlatformsWindows, Linux, macOS Post date shownOct 6, 2026 ### What the post advertises - 90% affiliate revenue share - Assistance obtaining legitimate access - File extraction capability - Windows locker using AES-256 and RSA - Exclusions and selective targeting - Shape-shifting capability - System customization - Stealth features - Windows free-space wiping - Windows complete disk and data coverage - Linux locker capability - macOS file extractor - macOS custom code via Bash script - Control-panel build configuration - 24/7 customer support - Detailed analytics - Affiliate leaderboard - $170 one-time invitation fee The post presents FLOCKER as an active affiliate operation and describes a control panel intended to let affiliates configure builds and review operational statistics. No working samples, binaries or independent technical validation are shown in the supplied screenshot. Sponsored [ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) ### Screenshots [ Screenshot 1Source screenshot ![Post advertising the FLOCKER ransomware affiliate program, including revenue share, cross-platform capabilities, control-panel features, invitation fee and Session contact](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/flocker_ransomware.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/flocker%5Fransomware.png) The supplied capture shows the FLOCKER affiliate recruitment post, the advertised 90% revenue share, claimed Windows/Linux/macOS capabilities, control-panel features, $170 invitation fee and a Session contact identifier. ### IOCs & contact identifiers Identifiers directly visible in the supplied material. These support correlation and do not independently identify the person operating the account. | Type | Identifier | Source | | ------------ | ------------------------------------------------------------------ | ------------ | | Actor handle | greens6699 | Screenshot 1 | | Session ID | 05e392b8fc91277ec543f3c0bc20320f5d649259138af35c0889b077a23014da74 | Screenshot 1 | No Tox ID, Telegram handle, malware hash, attacker-controlled domain or attacker-controlled IP address is visible in the supplied material. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed. ### Mapped techniques **Claimed** identifies behavior explicitly advertised by the actor. **Inferred** identifies an analytical mapping supported by the supplied material. Neither label means the capability has been independently validated. - Impact [T1486](https://attack.mitre.org/techniques/T1486/) [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/) Claimed The advertisement explicitly describes locker functionality using encryption on Windows and Linux, consistent with data-encryption-for-impact behavior. - Collection [T1005](https://attack.mitre.org/techniques/T1005/) [Data from Local System](https://attack.mitre.org/techniques/T1005/) Inferred The advertised file-extraction capability suggests collection of local files before or alongside impact operations, although the screenshot does not show the implementation. ### Potential impact If the advertised capabilities are genuine, affiliates could use the service to support **data theft, file encryption, operational disruption and extortion** across Windows, Linux and macOS environments. The combination of selective targeting, build customization and claimed access support could increase operational flexibility for participating affiliates. ### Status Observed The supplied screenshot directly documents the FLOCKER recruitment advertisement and its stated features. Dark Web Informer has **not independently verified** that the advertised malware capabilities, control panel, affiliate payouts, support services or access-procurement claims are functional or currently operational. Want everything on this threat? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=flocker-affiliate-program-2026-10-06&utm%5Fcontent=threat-feed) and search there for this alert. [View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=flocker-affiliate-program-2026-10-06&utm%5Fcontent=pricing-button) [Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=flocker-affiliate-program-2026-10-06&utm%5Fcontent=footer)