14367
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
We're doing a merch giveaway on Xitter.
https://x.com/vxunderground/status/1843479223446778080
Why even ask us for merchandise, or stickers, if you're going to freak out when we say yes? How are we going to physically mail you something if you can't provide us a physical address?
real world things require real world address, the real world isnt the internet ok
Thank you to whoever lives in Milton Keynes, UK and decided to spray paint our website onto a wall.
You kind of messed up the centering, you had to do a weird trail off for .org, but overall we give it a 8/10
Hello, how are you?
tl;dr tl;dr I'm sick, update on ransomware leak, update on video game 0day, stuff
Apologies for so many delayed communications — I have contracted some sort of viral infection. My sinus' have begun draining fluid into my esophagus. tl;dr Sinusitis. As this post is being written, I have consumed enough Robitussin to kill an Elephant.
Anyway, regarding the ransomware leaks, the data is a result of an unknown person(?) compromising ransomware threat actor VPS'. Once the individual compromised the VPS' they decided to forfeit the data over to law enforcement (anonymously) which they believe resulted in the apprehension of individuals and the takedown of several onion domains. Following the takedown and arrests, this person (people?) decided to gift the data to us to study or distribute to others. They believed that, due to the size of our audience, us announcing it and sharing it would disseminate information faster. Because this person(s) compromised a VPS, it has a great deal of victim PII present — it appears they compromised some of their hosts mid-ransomware campaign or attack. In order for us to share it, we need to scrub the victim PII. We still haven't done that (see why in first paragraph).
However, we have decided we will share the data to Threat Intelligence vendors, or anti-virus vendors, or whomever to study, review, blah blah blah. We believe these companies, which typically offer anti-ransomware services, will make good use of this information and data. Truthfully, we ourselves have not reviewed the data in totality. Our domain of study typically revolves around malware development — reviewing VPS data is kind of a Threat Intel / DFIR thing, so there is a lot someone could probably find that we would probably miss. If your organization is interested in the data to do a review, or write-up, or whatever, shoot us an e-mail or a DM or something. You'll need to show us proof you're from a legitimate vendor.
We have no timeline on a public release. I don't feel like scrubbing the PII, maybe someone else in our group feels like it, I don't know, I haven't asked because I've been sick. I could probably ask right now, but I'm not.
About the video game 0day, very few people are aware of its existence and we believe it will cause a mini-shit storm online. It's high severity, but it's impact is limited to a relatively small userbase. I've sworn on the Old Robitussin bottle and the New Robitussin bottle (Game of Thrones reference) to not disclose more information. Regardless, you'll all have a nice chuckle. It's disclosure timeline is roughly 7 - 14 days. The person who found the exploit is doing a writeup. Upon release, the exploit will not be patched.
Finally, we've got lots of updates to vx-underground. I haven't pushed any to prod yet (despite the pile up from petik, Bradley, and GuessThePwd), because I've been sick.
Have a nice day,
- smelly
We have appeared in another YouTube documentary. It is always a wonderful feeling knowing we are becoming part of history and making an impact.
Sometimes though it is our silliest quotes that make it into documentaries.
The unknown person who claims to have compromised zserver dot ru, the bulletproof webhosting provider, has begun sending emails to zserver dot ru clients.
Interestingly, the person who claimed to have compromised zserver dot ru did not tell us this.
One of their customers did.
A ransomware group was compromised.
It contains some interesting information — it's their tooling, some minor chat information, infrastructure credentials, internal notes, etc.
It's going to make some people VERY angry.
tl;dr mini Conti leaks
Exploit development, or dealing with exploits in general, is like purchasing some fresh food from a farmers market. It is new, clean, and pretty.
Malware development is like finding a 20 year old can of peas in your basement. It's old as hell, looks gross, but its still okay
Despite saying it was a joke, Linux nerds continue to comment on our post. Here is a few snippets.
A majority of people in screenshot do not follow us on Xitter.
Our favorite is the university professor saying we should be community noted. We hope they're joking.
After our stupid Linux joke, we woke up to hundreds of angry Linux nerds screaming at the top of their lungs.
The Linux nerds got so mad they even tried to community note us on Twitter
This is a joke — it was supposed to be obvious from the high person react face.
The joke is poking fun at how, although Linux is described as the superior OS, it can sometimes be more complex for even basic tasks. This is depicted in this exaggerated Linux terminal command.
EvilCorp is unironically a family owned and operated cybercrime business
Читать полностью…
Also, at the 3:32 marker, they arrest someones Grandpa. Dude looks like he's 70 and running a giant ass cryptolaundering operation 😭😭
Читать полностью…
Good evening,
We've got a bunch of malware in queue. Some has already been pushed to prod. It is over 1,000,000 malwares.
Additionally, please give us time to review the over 700 animal pictures we received. We didn't anticipate so many critter pictures.
Thanks,
Hello, we are a malware library.
We are not a cult.
Please don't go around tagging buildings with our logo(s) or website URL. 😭😭😭😭
> "smelly can i have {free merch} for {thing}? "
> "sure"
> "nice try u fuckn fed ur never gettin my dox"
That's crazy. We are indeed interested in The largest collection of malware source code, samples, and papers on the internet.
Password: infected.
How did they know?
Full video by YouTuber 'fern'
Video:
https://www.youtube.com/watch?v=F7iLfuci75Y
A 0day exploit is going to be dropped soon. We ourselves aren't entirely clear on the details yet, but we know it is going to impact gamers.
It won't impact business operations, unless your end users are unironically playing video games at work.
Hello,
It has come to our attention more people have received the recent ransomware leak.
Our advice is to tread carefully. Our primary delaying factor is the presence of victim PII — most notably data from public schools who may or may not have paid the extortionists.
In other words, we aren't making it public until we feel comfortable sharing data we believe people can get value from and learn from, without putting past victims in danger again.
tl;dr not going to distribute hacked schools information and data
y'know those articles on the process environment block, walking the NTDLL export-address-table? Thats from 29a zine 2... in 1997. It's a 27 year old technique that everyone is still using and yappin' about.
Читать полностью…
It's been almost 24 hours and the internet fist fight between Linux nerds and non-Linux continues.
The Linux nerds have begun implementing guerilla warfare — it has become a battle of the Xitter Community Note.
Rory Stephen Guidry a/k/a KMS has passed away. He was 37.
Rory was an active person on Darkode. He was sentenced in 1 year in prison in 2016 for cybercrime related charges.
March 24, 1987 - October 01, 2024
Also, also, yes — if there are too many .zip files in a directory (in this specific instance, for downloading malware), rm will indeed say there are too many arguments.
The solution is shrimple: find . -name "*.zip" -type f -delete
Thanks for visiting the Ted Talk
LiNuX iS tHe sUpErIoR Os
Delete all zip files in a directory on Windows:
del *.zip
Delete all zip files in a directory on Linux:
find "$(pwd | awk '{ print $1 }')" -type f -name "*.zip" -exec sh -c 'for file; do if [ -w "$file" ]; then rm -f "$file"; fi; done' sh {} +
BREAKING: Gen Threat Labs finds Rootkit targeting Arch Linux.
This puts at least 50 people worldwide in danger.
Highlight of the video is the cute doggie at the beginning doing a little dance as his owner is being arrested by the FSB 🥺
He seems excited to have so many people over, doggo thinks its a party