14367
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
13-year-old Marco Liberale has created a proof-of-concept PasteBin C2 botnet in Go. Is it fully cross platform working on Windows, Linux, and Mac.
We are very happy to see such a young person contributing to this research space.
Check it out here: https://github.com/marco-liberale/PasteBomb
Today a group named 66slavs claimed to have breached the United States National Energy Research Scientific Computing Center (NERSC).
* We have not reviewed the data
* Yes, they watermarked a data breach
"Does {book} cover everything I need to know about malware?"
No book ever released has covered 'everything' about malware. If you wanted a book to cover everything on malware it would weigh 500lbs (226kg) and be cartoonishly large.
Awhile back we heard rumors of a Telegram RCE 0day. We brushed it off as silly memes. Turns out the 0day was 100% real and you're all probably pwned.
It was unveiled on XSS. Nerds celebrated
(joking about pwned part... kind of)
More information: https://www.bleepingcomputer.com/news/security/telegram-fixes-windows-app-zero-day-used-to-launch-python-scripts/
We have a lot of malware samples and malware papers to add. Unfortunately, due to IRL responsibilities this will not happen immediately.
To compensate for this setback we have drawn a shitty picture in MS-PAINT which could illustrate what could have been added
The show also features the head of the FBI Cyber Crime division, Bryan Vorndran, and ex NSA Cyber Security director Rob Joyce.
You can watch the video here: https://www.cbsnews.com/news/cybersecurity-investigators-worry-ransomware-attacks-may-worsen-as-young-hackers-in-us-work-with-russians-60-minutes-transcript/
ok, 1 last schizo meme tech post (stolen from telegram) on the day of rest. sorry
Читать полностью…
More information on the Cyb3rAv3ngers
https://twitter.com/aejleslie/status/1753461599715652021
Here is your daily dose of LOLWTF
- Toyota Brazil ransomed by Hunters International ransomware group
- Department of Insurance, Securities and Banking ransomed by Lockbit ransomware group
- Probably like a dozen or so small businesses ransomed which are unable to afford cybersecurity software
- Hunters International ransomware group and RansomHub ransomware group are the flavor the week
- Lockbit administrative staff yelling at affiliates to not give more than a 50% discount
- Windows 11 will start showing 'recommendations' which look very similar to ads, they don't say they're ads though just recommendations that you can disable if you look hard enough in your settings
- Ubisoft revoking gamers abilities to play The Crew 1 because they shut down servers, nerds rage because digital purchases aren't real purchases anymore
See you space cowboy...
> login to twitter
> check recommended news
> twitter recommends us to us
Hello, how are you?
Harddrives are back in stock. Merch store is back open for a limited time.
https://www.vx-underwear.org/
We did a spam test on Twitter. We got 21 spam replies in 30 seconds. It keeps climbing.
https://twitter.com/vxunderground/status/1778807528417116177
> wake up
> check news
> 0day exploited in the wild
> scroll down
> police offices being ransomed
> ransom group threatening to leak data on rape victims
> scroll down
> "nudes in bio"
Happy Friday.
We've also distributed complete copies of our collection to people all across to globe. In the event that every single person with access to vx-underground dies in a horrific airplane crash – someone will be able to continue our legacy.
Cheers
Yesterday Christopher Ahlberg, the CEO of RecordedFuture, shared information on an unidentified Threat Actor attempting to SMS phish employees at their organization
- This message was not sent to a Nikolas
- Who the hell is Nikolas
babe wake up mandiant just released artwork for sandworm aka apt44 (officially)
Читать полностью…
On the Windows platform there dozens of ways to achieve persistence, shellcode execution, process injection, – hundreds of different ways to abuse system components
There are tons of little caveats, niches, tweaks and tricks you can do that are often over looked
tl;dr big book
Today we will give all of you a lesson on computer hardware. This comprehensive video will explain the different components of a computer and how it all comes together to make the magic of the world wide web
Читать полностью…
The Breach forum .cx has been suspended – as is tradition.
The .onion is still live – as is tradition.
Believe it or not, this is what a real network administrator looks like
Читать полностью…
Today on CBS News 60 minutes – Cyber Threat Intelligence experts went on national television to discuss ransomware. Most interestingly, during the airing of the segment, researchers discuss "the Com".
They highlight "JackIdiot", "Star Chat", "Flawless" and "Fresh"
Yesterday the Cyb3rAv3ngers contacted us – a group tied to the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).
Based on the events unfolding right now this message is suddenly very ominous 👀
Ubisoft has begun revoking the ability for people to play "The Crew" because they're shutting the servers down at the end of April.
The Crew has an offline single player option.
When people try to launch the game they're greeted with "You no longer have access to this game".
Today we spoke with RansomHub ransomware group.
Their representative immediately wanted to dispel any rumors of them being a potential rebrand of ALPHV ransomware group – they assert they're victims of the ALPHV exit scam. They appear to be hyper-aware of these allegations, suggesting they're (probably) on social media and actively monitoring discussions regarding their group.
Additionally, they shared with us various documents which illustrate possession of sensitive data from the United Healthcare Group breach.
* We are unable to verify the authenticity of these documents. However, we do not question the validity of the documents shown. We believe the data to be real.
* There is currently no concrete evidence to suggest RansomHub is a rebrand of ALPHV. Currently accusations of them being a rebrand primarily revolve around the time of their initial launch and 'gut feelings'. To the best of our knowledge there is not any other publicly available information which proves beyond a reasonable doubt this is ALPHV.
* No RansomHub ransomware group payload has surfaced online. We do believe it exists. They are either undiscovered or labeled TLP:RED and are not shared publicly. Some reports suggest the payload is written in Go, but no IOCs were shared.
* RansomHub would not share a malware sample with us. RansomHub would not provide us with photos or access to their ransomware affiliate panel. RansomHub told us they're currently re-developing (?) their ransomware payload.
The spam bots are recursively replying to each other because their spam messages contain key words other spam bots use
tl;dr spam inception
https://twitter.com/rosenwells/status/1778809976930115626
> Elon Musk vows to crack down on porn spam
> record scratch
> window breaking noise
> Stone Cold Steve Austin music plays
Unbelievably, upon review, we realized we have crossed off ALMOST our entire to-do list. It only took 4 years and 11 months.
- 36,000,000+- malware samples
- 19,852 papers
- 38,793 APT papers and/or samples
- 3,206 malware sources
- VXDB developed and implemented