14367
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
We were under the impression, based on scarce details we received, this was a remote-code-execution 1337 exploit. This is not a super 1337 bug. This is... probably one of the silliest things we've seen in awhile...
Читать полностью…
Happy to announce we now have 31,335,000 unique malwares.
We're slowly creeping our way up to the big 40,000,000. When we hit 40,000,000 malwares we're going to throw a pizza party, but limit 0.00012 slices per person and the only drinks available is tap water.
The individual who compromised the SEC Twitter account has been apprehended by the United States Federal Bureau of Investigation
Additionally, if you've commited a felony, do not use your personal computer to Google if you're being investigated.
Remember that video game 0day we mentioned? The rumors were true.
Read the post for more details. The tl;dr is an exploit can trigger Call of Duty anticheat and get innocent people banned.
It appears the individuals using the exploit have framed popular video game streamers.
Earlier today it was reported a 33 year old male was arrested in Brazil by the Polícia Federal in "Operation Data Breach".
The suspect is believed to be USDoD a/k/a EquationCorp.
Although documents do not explicitly state USDoD a/k/a EquationCorp was arrested, the official press release states the individual arrested boasted the compromise of Infragard — a breach which USDoD took responsibility for.
USDoD has been listed in multiple court documents in the United States since atleast 2022. Most notably he was listed throughout the court documents of the arrest of Pompompurin a/k/a Conor Fitzpatrick, naming USDoD as a prolific Threat Actor.
USDoD has taken responsibility for large compromises such as Infragard and the National Public Data breach. The National Public Data breach which exposed information on hundreds of millions of Americans and resulted in the company filing for bankruptcy.
This arrest comes after the 'dox' of USDoD by security company CrowdStrike. USDoD denied the information released and said it was accurate.
Press release:
https://www.gov.br/pf/pt-br/assuntos/noticias/2024/10/pf-prende-hacker-suspeito-de-invadir-sistemas-da-pf-e-de-outras-instituicoes-internacionais
BianLian ransomware group announced they've ransomed a children's healthcare facility.
Читать полностью…
The BBC reports the Internet Archive has been compromised by a Threat Actor operating under the moniker "Have I Been Pwned".
This is unequivocally false.
The BBC has incorrectly attributed the compromise to the the website owned and operated by security researcher @TroyHunt
Unrelated to malware.
This textbook, presumably from China because it's written in Mandarin, is an excellent illustration of how Turtles' shells work.
Education is important!
Yes, some of us are Ameriburgers.
Some of our staff members are in Europe, and big chunk of our followers are in Europe, Canada, South America, and Australia. Not everything we say or do may not align with our American audience.
Yesterday Chinese researchers from Shanghai University unveiled a technique to defeat RSA and AES encryption using Quantum Computing.
The paper titled: "Quantum Annealing Public Key Cryptographic Attack Algorithm Based on D-Wave Advantage", is in Mandarin and has lots of maths
You can either read what other journalists wrote, or you can try to read it yourself.
The original paper: http://cjc.ict.ac.cn/online/onlinepaper/wc-202458160402.pdf
A beta version of Pokémon X&Y has leaked online.
We've seen some download links — but we're too afraid to mention it because we don't want Nintendo to send the Yakuza to our homes
eSUN 3D Printing has upgraded their stuff. All user credentials are now email:email
Photos via GatorzVR
September 17th a person named Prakash filed an official complaint against our donation transaction system stating we have failed to give them the password for the malware folder.
It wasn't a meme, it was completely legitimate.
The password is 'infected'.
uBlock Origin has been flagged by Google as 'not following best practices' from the Google Chrome web store — sparking concern it may be removed. Internet nerds are moving to Firefox or Brave.
Some are stragglers and are using uBlock Origin Lite on strict mode to combat ads.
Call of Duty exploit dropped.
tl;dr using the string "Trigger Bot" in Call of Duty gets someone banned. Attached image shows getting someone banned. File attached gives a little more detail.
Regarding our previous discussions on the Call of Duty exploit: we have decided to translate the post into verbage we believe Call of Duty players may comprehend better.
Translation:
tbh p much like, a long ass time ago we heard mfers found a way to put known garbage ass cheats into mfers pcs. the cod anticheat ricochet thing was hella janky and somehow some dorky ass losers could sneak shit into ppls shit. they was using that shit to ban streamers they didnt like LMAO then like, when they were dying watching mfers accuse this innocent ppl of cheating. its wild as hell tbh. but like, now some mfers wanna expose that shit publicly because, idk, ig they wanna shame call of duty and get clout and redeem some ppl because some mfers feel bad innocent cuz innocent ppl got cooked. its prolly legit bcuz we know some of these ppl and theyre p cool and legit, idk tho id bet its like, 95% real.
> Anonymous Sudan DDoS us
> Record scratch
> Window breaking noise
> Fast forward 1 year later
> Life in prison
Today the United States Department of Justice, in conjunction with industry partners Akamai SIRT, Amazon Web Services, Cloudflare, Crowdstrike, DigitalOcean, Flashpoint, Google, Microsoft, PayPal, and SpyCloud — announced the indictment of 2 brothers believed to be behind Anonymous Sudan via Operation PowerOFF.
Anonymous Sudan is allegedly operated by Ahmed Salah Yousif Omer, 22, and Alaa Salah Yusuuf Omer, 27. Both individuals resided in Sudan, as their group name states.
Previously, some Cyber Threat Intelligence researchers speculated Anonymous Sudan to be state-sponsored by the Russian Federation due to the frequent regurgitation of Russian propaganda. Interesting, they are NOT state sponsored — the information they disclosed regarding themselves was indeed true. They were indeed from Sudan and were not affiliated with any government entity.
The United States Department of Justice has seized and taken down infrastructure of Anonymous Sudan which includes their tooling ("Godzilla", "Skynet", and "InfraShutdown"). They believe Anonymous Sudan to has caused approx. $10,000,000 in damage.
Throughout their brief tenure 2023 and 2024, they are believed to have launched over 35,000 DDoS attacks and targeted nearly 70 companies.
The United States Department of Justice has confirmed the individuals behind Anonymous Sudan are in custody and are being questioned by the United States Federal Bureau of Investigation.
If convicted Ahmed Salah Yousif Omer, 22, is facing life in prison. His brother, Alaa Salah Yusuuf Omer, 27, is facing 5 years in prison.
https://www.justice.gov/usao-cdca/pr/two-sudanese-nationals-indicted-alleged-role-anonymous-sudan-cyberattacks-hospitals
USDoD was arrested today. This is further proof of the crack down law enforcement is performing. A few years ago many assumed him to bullet proof because he is Brazilian.
They were wrong.
https://g1.globo.com/politica/noticia/2024/10/16/pf-prende-hacker-de-33-anos-suspeito-de-invadir-sistemas-e-vazar-dados-de-policiais.ghtml
Updates:
Papers:
- 2009-05-03 - PE Infection - How to Inject a DLL
- 2017-03-21 - Cloak and Dagger - From Two Permissions to Complete Control of the UI Feedback Loop
- 2020-08-10 - NFCGate - Opening the Door for NFC Security Research with a Smartphone-Based Toolkit
- 2022-01-30 - Retrieving the current EIP in C⁄C++
- 2022-01-30 - SetTcpEntry6 - A custom SetTcpEntry implementation for IPv6
- 2022-02-01 - System-wide anti-debug technique using NtQuerySystemInformation and DuplicateHandle
- 2022-02-02 - Reading and writing remote process data without using ReadProcessMemory ⁄WriteProcessMemory
- 2022-02-04 - CallRemoteAPI - Call functions in remote processes
- 2022-02-04 - CreateSvcRpc - A custom RPC client to execute programs as the SYSTEM user
- 2022-02-04 - EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution
- 2022-02-06 - HijackFileHandle - Hijack a file in a remote process without code injection
- 2022-02-08 - StackScraper - Capturing sensitive data using real-time stack scanning against a remote
- 2022-02-10 - WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory
- 2022-09-09 - WriteProcessMemoryAPC - Write memory to a remote process using APC calls
- 2022-10-20 - SharedMemUtils - A simple tool to automatically find vulnerabilities in shared memory objects
- 2022-12-10 - StealthHook - A method for hooking a function without modifying memory protection
- 2023-01-11 - SelfDebug - A useless anti-debug trick by forcing a process to debug itself
- 2024-09-03 - RAMBO - Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM
- 2024-09-07 - PIXHELL Attack - Leaking Sensitive Information from Air-Gap Computers via 'Singing Pixels'
Initially it was (incorrectly) assumed we have compromised the Internet Archive based on the wording of our initial post regarding the compromise.
Now it is incorrectly being reported Troy Hunt compromised the Internet Archive
CIA and NSA nerds following vx-underground right now:
Читать полностью…
Updates:
Archives:
- The Old New Thing, September 2024
Bulk downloads:
- MalwareIngestion2024.10.10
- MalwareIngestion2024.10.11
- MalwareIngestion2024.10.12
- MalwareIngestion2024.10.13
- MalwareIngestion2024.10.14
- VirusSign.2024.10.12
- VirusSign.2024.10.13
- VirusSign.2024.10.14
- Bazaar.2024.09
Malware families:
- AilurophileStealer
- Amadey
- Android.Copybara
- AsyncRAT
- BansheeLoader
- DCRat
- DMALocker
- Emotet
- Fysbis
- Gafgyt
- HzRAT
- KTLVdoor
- Lactrodectus
- LummaStealer
- NeutrinoBot
- PupyRAT
- QuasarRAT
- RedLine
- RhadamanthysLoader
- Sliver
- SmokeLoader
- SnakeKeylogger
- ToneShell
- Vidar
- XenoRAT
- XWorm
Papers:
- 2020-07-16 - Masking Malicious Memory Artifacts Part II - Blending in with False Positives
- 2020-08-04 - Masking Malicious Memory Artifacts Part III - Bypassing Defensive Scanners
- 2022-02-14 - Abusing Exceptions for Code Execution Part 1
- 2022-04-02 - CreateSvcRpc - A custom RPC client to execute programs as the SYSTEM user
- 2022-04-04 - Sharing is Caring - Abusing Shared Sections for Code Injection
- 2022-10-12 - StealthHook - A method for hooking a function without modifying memory protection
- 2023-01-30 - Abusing Exceptions for Code Execution Part 2
- 2023-07-15 - Poch Poch is this thing on - Bypass AMSI with Divide and Conquer
- 2024-10-15 - Introducing Early Cascade Injection from Windows process creation to stealthy injection
We understand this may be difficult for our Ameriburger audience to understand, but not everyone who follows vx-underground is located in the United States
Not everything we do is Burger-centric and not everything is related to Ameriburger
It's going to be okay, pinky-promise
We've updated the vx-underground GitHub malware source code collection.
- Win32.BabylonRAT
- Win32.NjRat
- Win32.Ransomware.Chaos
- Win32.Ransomware.Yashma
- Win32.RedlineStealer
- Win32.CHMiner
- Win32.CometRAT
- Win32.PentagonRAT.Builder
and more...
https://github.com/vxunderground/MalwareSourceCode
Yes, having your login email also be your password is standard procedure, this is very normal and safe. Don't worry.
Читать полностью…
We're being discriminated against — you'll hear from our lawyers.
Читать полностью…
The notice on the page doesn't explicitly state what uBlock Origin is, or is not, doing to be flagged as not following best practices.
People are theorizing this is Google strong-arming ad blockers so they can boost their ad revenue on places like YouTube
Internet web designer drama today.
Advanced Custom Fields, a WordPress plugin that allows people to modify pages easier, and offers a paid version, has been usurped by WordPress itself.
WordPress pretty much told them to piss off, causing a massive shitstorm