Recently several new Agobot backdoor variants were discovered. The most widespread at the moment is Agobot variant that we detect as 'Backdoor.Agobot.fo'. We also got infection reports about another Agobot variant: 'Backdoor.Agobot.ev'. Both these variants have 'phat' strings in them. Additionally in 'Agobot.fo' variant the 'Agobot' string is changed to 'Phatbot'. This indicates that both these variants were most likely made by the same person or group.