Cyber Threat Actor: Fokinz

The threat actor known by the alias Fokinz has been associated with a single publicly reported intrusion. Open‑source reporting identifies the actor’s location as Russia. No other aliases or personal details have been disclosed in the available sources.

On 8 May 2015, Fokinz allegedly compromised the website euromilhoes.com. The breach resulted in the exfiltration of a database containing usernames and passwords. Approximately 19,352 account credentials were disclosed in the dump.

The available reporting does not describe any specific malware families, exploit tools, or initial‑access vectors linked to Fokinz. Consequently, no characteristic TTPs can be derived from the existing public record. The actor’s tooling style remains unspecified in the sources consulted.

Attribution to a state sponsor, criminal syndicate, or any broader affiliation has not been established in the open‑source material. The sole geographic indicator is the statement that the actor operates from Russia. No further links to other threat groups or campaigns have been publicly documented.

To date, the 2015 euromilhoes.com credential dump is the only publicly cited operation attributed to Fokinz. No additional campaigns, data leaks, or intrusion claims have been reported under this alias. Accordingly, the actor’s activity profile is limited to this single incident.