14367
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
Regarding the recent so-called 'CrowdStrike' breach which was posted on BreachForum: this is not a data breach.
The individual responsible for the information ....disclosure, ...leak (?), operating under the moniker USDoD, openly states the data is scraped. Not sure why it's being labeled as a breach.
We briefly spoke with USDoD regarding it this afternoon. In summary, USDoD was able to programmatically abuse CrowdStrike endpoints to pull IOCs from CrowdStrike. The data pulled is proprietary, however this is the same information which is distributed to consumers.
According to USDoD scraping this data took quite a bit time (roughly a month), and the time the scrape operation completed it just so happened by chance to coincide with the recent CrowdStrike scandel – they've got bad luck it seems.
Photo courtesy of FalconFeedsio
As many of you (probably) know – the BreachedForum version 1. database was leaked yesterday. This database contains private messages, IP addresses, e-mail addresses, blah blah blah.
We've seen people express concern over this leak, notably some Threat Actors who believe this puts them in a bulls-eye for law enforcement.
Law enforcement agencies have had this data since Pompompurin was arrested in 2023. The only threat Threat Actors face now is the wrath, or retaliation, of other Threat Actors.
Law enforcement agencies are probably laughing right now, legs propped up on the desk, drinking coffee, and enjoying the fact that individuals they want apprehended are fighting others individuals they want apprehended.
tl;dr criminals destroying themselves
404media is reporting Reddit is blocking ALL search engine crawls EXCEPT Google – which is currently paying $60,000,000/year for the right to scrape Reddit for AI training data.
More information:
https://www.404media.co/google-is-the-only-search-engine-that-works-on-reddit-now-thanks-to-ai-deal/
Unironically, in the past vx-underground members have had difficulties passing background checks because of the amount of information required – in-depth job history, birth certificate, other forms of government identification, etc.
Yet North Korea passes it first try 😭😭😭😭
EDIT: It was posted on Breached on Sunday. We don't internet on Sundays
Читать полностью…
Updates to vx-underground:
Papers:
- 2024-02-20 - Earth Preta Campaign Uses DOPLUGS to Target Asia
- 2024-04-09 - Unraveling Not AZORult but Koi Loader- A Precursor to Koi Stealer
- 2024-05-21 - Phobos ransomware launches new leak site and pivots towards double extortion
- 2024-06-05 - European Election Security At Risk- A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats
Malware family updates:
- Poseidon
- ChChes
- SageRansomware
- Shifu
- SnakeKeylogger
- FakeBat
- Mirai
- LummaStealer
- Android.Rootnik
- FinSpy
- Latrodectus
- NeutrinoBot
- KematianStealer
- EyePyramid
- FormBook
Bulk downloads:
- VirusSign.2024.07.20
- VirusSign.2024.07.21
- VirusSign.2024.07.22
- VirusSign.2024.07.23
There is a REAL WORLD CHANCE your shitty memes could be in a history book 😭😭😭😭😭
Читать полностью…
Remember when Shou Zi Chew, the CEO of TikTok, testified before the United States congress and they grilled him on questions about WiFi or TikTok monitoring IOT devices?
Imagine the CEO of CrowdStrike having to explain an EDR to the United States Congress 😂😂😂😂
Today (or yesterday depending on where you live) the United States House Leaders called CrowdStrike CEO George Kurtz to testify to congress about the recent botched update. According to Microsoft telemetry, CrowdStrike's botched update boot-looped roughly 8,500,000 computers across the globe – including computer operations regarded as critical infrastructure.
No date has been released yet when George Kurtz will testify.
United States Republicans who lead the United States House Homeland Security commitee stated they 'expect answers soon' from Mr. Kurtz.
Additionally, it is reported that the letter sent to Mr. Kurtz by the United States congress states Mr. Kurtz is 'urged' to schedule a hearing with the subcommitee on Cyber Security and Infrastructure Protection by Wednesday, July 24th, 2024.
Information via Reuters, The Associated Press, and The Washington Post
The CrowdStrike C-suite LinkedIn apology post tl;dr
Читать полностью…
> open xitter
> see long winded rants about kernel mode drivers
> see long winded rants about crowdstrike
> see long winded rants about malware
Hello, how are you?
Today is the day of rest.
We hope all of you can find some time to relax too — it's been a chaotic week.
We'll see all of you on Monday.
We've updated the vx-underground malware collection. We have decided to include the recent faulty CrowdStrike drivers which caused 'boot-loops' for users. We believe it serves some historic and/or educational value to researchers or students. We have titled it "Win32.CrowdStruck". It is in the families directory.
- VirusSign.2024.07.13
- VirusSign.2024.07.14
- VirusSign.2024.07.15
- VirusSign.2024.07.16
- VirusSign.2024.07.17
- VirusSign.2024.07.18
- InTheWild.0129
- Win32.CrowdStruck
- CryptoMixRansomware
- AsyncRAT
- ClipBanker
- ProLock
- ThanosRansomware
- Redline
- Vidar
- Sality
- StealC
- RhadamanthysLoader
- RecordBreaker
- NjRAT
- LummaStealer
- PureLogStealer
- CobaltStrike
Today Microsoft reported that they believe the CrowdStrike bug has impacted roughly 8,500,000 computers.
https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/
We have deleted our post addressing the conspiracy theories about the CrowdStrike thing.
We were bombarded with comments and political fighting.
It's Saturday and we're not going to deal with this shit on our weekend. We'll let someone else do it.
Per TechCrunch / lorenzofb – CrowdStrike is offering a $10 Uber Eats giftcard to individuals impacted by the recent CrowdStrike outage.
$10 USD is €9.21 EURO or £7.75.
There is no indication if this is per customer, per company, or per computer. Additionally, some users reportedly received an error message from Uber Eats when trying to use the giftcard with Uber Eats displaying the error message: "[this giftcard] has been canceled by the issuing party and is no longer valid."
More information:
https://techcrunch.com/2024/07/24/crowdstrike-offers-a-10-apology-gift-card-to-say-sorry-for-outage/
Yesterday Dragos unveiled 'FrostyGoop' an ICS (Industrial Control System) malware suspected to be developed by Russia's infamous sandworm team.
FrostyGoop successfully shut off the electricity of 600 apartment buildings in the midst of sub-zero temperatures (sub -17C temperatures) in January, 2024. It took Ukrainian officials almost 2 days to restore electricity of individuals impacted by FrostyGoop.
Dragos successfully identified the payload April, 2024.
This is the 9th ICS specific malware in history. This sort of malware is exceptionally rare, exceptionally difficult to develop, exceptionally difficult to test, and exceptionally difficult to deploy.
We do not have any malware samples for this payload. If one of you have this malware sample and would be willing to donate it to us, please do.
Check out the intelligence brief here:
https://vx-underground.org/APTs/2024/2024.07.24%20-%20FrostyGoop%20Intel%20Brief
Yesterday KnowBe4 disclosed a cyber-security-incident where a North Korean national successfully infiltrated KnowBe4 ... by applying for a job there, interviewing, and getting hired.
Their blog post highlights North Korean identity fraud techniques.
https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us
Some media outlets are reporting a compromise (and leak) of Leidos – a large IT service provider for the United States Pentagon.
Bloomberg reports the leak is being distributed on 'cybercrime forums' but we haven't personally seen anything about it anywhere.
¯\_(ツ)_/¯
20 years from now someone is going to write a book about the CrowdStrike disaster. People new to cybersecurity are going to be amazed by it.
The actuality of the situation is most security professionals (and Threat Actors) just shitposted their way through the entire thing
This by far one of the largest oopsies in cybersecurity history. We can't recall a moment where a vendor caused this much damage... ever. We're aware of instances where updates corrupted something, but nothing on this scale.
They'll probably talk about this in history books.
Anyway, unless something profoundly dramatic happens, we are no longer going to actively discuss the current CrowdStrike situation. We're fatigued – and various members are combating the fall out in their own way (organizationally, whatever).
tl;dr moving on
More annoyed at the fact CrowdStrike has brought in a surge of 'experts' than the actual computer damage at this point. We're going to hear idiotic schizophrenic rants for months
Читать полностью…
Good morning,
After we took Sunday off we anticipated things would calm down a little. We were wrong. There has been more arrests, the CrowdStrike fire is still burning, and the arguing about CrowdStrike continues.
😭😭😭
POV: you scroll the comment section of literally any Xitter post discussing CrowdStrike (someone is going to make it weirdly political and mention an acronym starting with the letter 'D')
Читать полностью…
To put that into perspective: that is nearly x3 the amount of the entire Linux user baser.
Haha just kidding:) we just wanted to make a jab at Linux nerds because they keep spamming "THIS IS THE YEAR OF THE LINUX DESKTOP"
Logging into Xitter and seeing thousands upon thousands of people, who have never written a single line of code their entire life and can barely use a computer, giving their expert input into kernel-mode programming
Читать полностью…
We somehow missed a semi-undocumented CrowdStrike EDR disable* technique that was unveiled in 2022.
It requires administrative access. This makes it more difficult to perform in enterprise environments.
Jonas Lyk discovered the CrowdStrike minifilter did not catch NtCreateFile when the FILE_APPEND_DATA access mask was present. It was possible to open a CrowdStrike driver with FILE_APPEND_DATA and append an additional byte to the driver opened.
When rebooting the machine, the driver signature would not match and CrowdStrike would not load.