14367
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
We got another 1,800,000+ malware samples cookin'.
We're at like, 22,000,000 unique samples. There is no reason why any individual should possess this much malware but here we are. ¯\_(ツ)_/¯
While you attended DEFCON, in pursuit of vanity, we studied the blade
Читать полностью…
Oh god, one of our typos is actually in a legitimate judiciary hearing. Now actual court officials, lawyers, and possibly a jury are going to see our dumbass typoes.
Читать полностью…
"Hate them – they sympathize with threat actors, foreign adversaries, and their memes suck. Actively distributing malware source code and builders is borderline criminal, they're doing more harm than good"
(just repeat the same stuff everyone else criticizes us for)
This took a long ass time to aggregate, you infosec nerds who put hashtag-malware and hashtag-apt in your Twitter bio better like this shit and download this shit.
Читать полностью…
The CEO of Intel publicly praying via Xitter following the layoff of 15,000 people and their stock falling 55% in the past 8 months
https://x.com/PGelsinger/status/1820129317122080977
> go to work
> print Alex Chan's PDF
> pdf larger than observable universe
> printer implodes
> vacuum created
> call DELL customer support to fix
In PDF Version 1.6 (Acrobat 7.0) and newer the theoretical PDF page size is 15,000,000"x15,000,000"
Or roughly 1,250,000ft x 1,250,000ft
Or roughly 236.7mi x 236.7mi
Or roughly 380.9km x 380.9km
...
Or (if math is right) 2,406,417,112,299 sheets of A4 paper?
> select 2 people
> both say they can't make it
/me rerolls
The malware ABC's
A is for Advanced Persistent Threat
B is for Botnet
C is for Command & Control
D is for Dridex
E is for Emotet
F is for FinSpy
G is for GandCrab
H is for HermeticWiper
I is for Industroyer
J is for JIT
K is for Kobalos
L is for Lockbit
M is for MyDoom
N is for NetWalker
O is for Obfuscation
P is for Pegasus
Q is for QakBot
R is for Redline
S is for Sandworm
T is for Trickbot
U is for Undetected
V is for VX
W is for WannaCry
X is for XMRig
Y is for You (for detonating the payload)
Z is for Zeus
We unironically tried to get malware from bootleg pornography sites. We got inundated with phony PC support call center scams, but we got tons of malware from game cheats linked on YouTube.
> Fortnite Cheats 2024 [Working]
> MediaFire download link in bio
> Cheats.exe
> Redline
A bunch of SIM swappers were arrested today in Canada. Some are now on the run. Currently too sleepy to do a full write-up so read it or research it yourself.
https://ca.finance.yahoo.com/news/ten-people-arrested-more-100-170910027.html
We're happy to announce a new category for malware samples. The malware ingestion category!
The malware ingestion category is samples submitted to us from individuals. It's roughly 25,000+ new malware samples a day.
Yay!
https://vx-underground.org/Samples/MalwareIngestion
This Xitter profile AI roast thing is supposed to roast you. This thing didn't even roast us – it just spoke the truth for a few sentences.
Читать полностью…
What does this mean? We have no idea. We don't do crypto stuff. We let ZachXBT handle that kind of work. We do however know nerds are screaming at us about it, so that means we have to mention it.
¯\_(ツ)_/¯
As is tradition, nerds have gone too far.
Researcher Ersei booted Linux off of Google Drive
https://ersei.net/en/blog/fuse-root
Nerds were able to transform Google Calendar into a filesystem.
tl;dr malware idea
https://github.com/lvkv/whenfs
Today vx-underground was mentioned in a class action lawsuit between CHRISTOPHER HOFMANN v JERICO PICTURES, INC. d/b/a NATIONAL PUBLIC DATA.
This is the first time one of our tweets has been used as evidence in a courtroom (to the best of our knowledge).
> go to work
> be in meeting
> "what's your opinion on vx-underground?"
> mfw
Large update this morning. Total number of new malware samples is roughly 500,000.
Updates:
*Note: Due to length of paper titles the APT paper names will be truncated in this post and instead focus on the Threat Group
- 2024.07.08 - CloudSourcerer
- 2024.07.09 - APT40
- 2024.07.10 - DodgeBox
- 2024.07.11 - Moonwalk
- 2024.07.15 - BugSleep
- 2024.07.16 - AG100
- 2024.07.18 - APT41
- 2024.07.18 - Patchwork Group
- 2024.07.23 - DaggerFly
- 2024.07.23 - KnowBe4 North Korean Compromise
- 2024.07.23 - TransparentTribe
- 2024.07.24 - Russian-nexus
- 2024.07.24 - UAC-0057
- 2024.07.25 - APT45
- 2024.07.25 - OnyxSleet
- 2024.07.25 - SideWinder
- 2024.08.01 - APT41
- 2024.08.01 - BitSloth
- 2024.08.02 - Ursa
- 2024.08.02 - StormBamboo
- 2024.08.02 - Turla
Bulk Downloads:
- MalwareIngestion.2024.05.13
- MalwareIngestion.2024.05.14
- MalwareIngestion.2024.05.16
- MalwareIngestion.2024.05.17
- MalwareIngestion.2024.05.18
- MalwareIngestion.2024.05.19
- MalwareIngestion.2024.05.20
- MalwareIngestion.2024.05.21
- MalwareIngestion.2024.05.22
- MalwareIngestion.2024.05.23
- MalwareIngestion.2024.05.24
- MalwareIngestion.2024.05.25
- MalwareIngestion.2024.05.26
- MalwareIngestion.2024.05.27
- MalwareIngestion.2024.05.28
- MalwareIngestion.2024.05.29
- MalwareIngestion.2024.05.30
- MalwareIngestion.2024.05.31
- Bazaar.2024.07
- VirusSign.2024.07.27
- VirusSign.2024.07.28
- VirusSign.2024.07.29
- VirusSign.2024.07.30
- VirusSign.2024.07.31
- VirusSign.2024.08.01
- VirusSign.2024.08.02
- VirusSign.2024.08.03
- VirusSign.2024.08.04
Families:
- EternalRocks
- DanaBot
- RedLine
- XenoRAT
- Numando
- PhiladelphiaRansomware
- Remcos
- RokRAT
- SmokeLoader
- SnakeKeylogger
- StealC
- Amadey
- CobaltStrike
- DCRat
- Dridex
- FormBook
- Gh0stRAT
- LummaStealer
- NjRAT
- PrivateLoader
Resorts World Las Vegas informed guests they'll be performing room inspections ... for your safety (?) because of the DEFCON cyber security conference.
Читать полностью…
Nevermind, Alex Chan proved you can actually far exceed that. They were capable of creating a PDF larger than the entire universe – 37,000,000,000,000 light years square.
They even made it available for download 😂😂😂
CrowdStrike showing up to advertise at a conference after their record breaking accidental DoS is absolutely crazy
Читать полностью…
We're giving away 2 entry badges to DEFCON on Twitter. We only have two. We're selecting winners tonight because the clock is ticking.
https://x.com/vxunderground/status/1819892171597644102
"I like Elephants and God likes Elephants" — Terry A. Davis on 16bit Elephant artwork on TempleOS
Читать полностью…
Legitimate pornography sites are significantly less likely to deliver malware because they want your money. If anything, it'll just blast you with affiliate advertisement scams. You're x10 more likely to get malware from arbitrarily executing random game cheats for Fortnite
Читать полностью…
It adds up to an additional 948Gb+ A MONTH in storage. Hopefully compression saves us a little on storage.
(please give us money, dear god)
This morning we learned we are infamous.
define: infamous
"well known for some bad quality or deed. wicked; abominable."
Cool 😎
Bringing in 500GB+ of malware a month on a budget of a Red Bull and a slice of pizza
Читать полностью…
Earlier today, around 9 hours ago as of this writing, Convergence (some crypto shit, we honestly have no idea what it is) confirmed a compromise – alerting it's userbase. PeckShield noted the discovery of a bug in their CvxRewardDistributor contract, which resulted in the theft of roughly $210,000.
Subsequently, 6 hours ago Starknet announced their Discord was compromised and sending users crypto-drainer links.