14365
The largest collection of malware source, samples, and papers on the internet. Password: infected Website: https://www.vx-underground.org/ vx-underground Telegram chatroom link: https://t.me/+njfLzUrqos01ZWNh
Still not as oopsie-doopsie as when the Indian military left the PDB data present which displayed the developers first name and last name, but making the path "hack" is pretty oopsie too.
Читать полностью…
The National Police Agency (NPA) of Japan recent documentation of state-sponsored Threat Actors from China is interesting.
A group they believe to be a subset of APT10, abuses WSB (Windows Sandbox) by creating a .wsb configuration file and using it to spin up an instance of the Windows Sandbox.
This is interesting because Windows Defender cannot access the Windows Sandbox (image 1).
The payload enables folder sharing, network access, clipboard access, microphone access, and video access.
tl;dr abusing the sandbox, sandbox as a c2
Windows 10 support ends October 14th, 2025. It is the calling of the Linux nerds.
Читать полностью…
"Nothing is certain except computer viruses and cat pictures" — Benjamin Franklin
Читать полностью…
me trying to have a rational conversation about computers with someone on twitter
Читать полностью…
Today Donald J. Trump signed a Presidential Memorandum revoking any active security clearance held by Chris Krebs and his associates.
This includes SentinelOne in totality.
More information: https://www.whitehouse.gov/fact-sheets/2025/04/fact-sheet-president-donald-j-trump-addresses-risks-from-chris-krebs-and-government-censorship/
Also, unrelated to Gronk, we've updated vx-underground. We've added InTheWild 140 - 151. This is 275,000 new malware samples.
Additionally, we've updated TheOldNewThing archive for January, February, and March.
Large paper tsunami coming today.
Cheers,
Hello,
Tomorrow we have a large update coming. Unsurprisingly, it is the same ol', same ol'. It is malware source code, samples, and papers.
-smelly smellington
P.S. glad so many of you liked the kitty cat collection. It's fun doing goofy stuff on the internet
Thank you, B F R e p o V 3 F i l e s, for sharing the cat picture collection. Not sure if you'd like to label it a breach, but we'll take it.
¯\_(ツ)_/¯
YOU'RE ALL TRYING TO PULL THE WRONG TORRENT
🗣REDOWNLOAD THE TORRENT WITH SEED
In these trying times the one thing which remains constant is the value of kitty cat pictures.
Please take a copy of our kitty cat picture collection. It is 159.9GB (111,429 files) of kitty cat pictures (a torrent!)
Economic problems 🤝Kitty cats
https://vx-underground.org/Torrents
Updates to the Malware Builder collection via Cryakl (may include subvariants)
-A7m3dRat
-CraxsRat
-Gh0stCringe
-HadesRat
-KazyBot
-Nbclass
-PhoenixKeylogger
-PurpleFox
https://vx-underground.org/Builders
APT samples and papers:
2024.10.24 - Operation Cobalt Whisper - Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan
2025.01.20 - Operation Hurricane - A brief discussion of the techniques and tactics of the Xinhai Lotus organization in memory
2025.01.21 - Love and hate under war - The GamaCopy uses military-related bait to launch attacks on Russia
2025.01.23 - Mapping Suspected KEYPLUG Infrastructure - TLS Certificates, GhostWolf, and RedGolf APT41 Activity
2025.01.23 - The J-Magic Show - Magic Packets and Where to find them
2025.01.28 - ScatterBrain - Unmasking the Shadow of PoisonPlug's Obfuscator
2025.01.29 - CL-STA-0048 - An Espionage Operation Against High-Value Targets in South Asia
2025.01.29 - Operation Phantom Circuit - North Koreas Global Data Exfiltration Campaign
2025.02.03 - Analysis of malicious HWP cases of APT37 group distributed through K messenger
2025.02.03 - macOS FlexibleFerret - Further Variants of DPRK Malware Family Unearthed
2025.02.07 - Chinese-Speaking Group Manipulates SEO with BadIIS
2025.02.11 - Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns
2025.02.12 - 2024 Global APT Research Report
2025.02.12 - Cybercrime - A Multifaceted National Security Threat
2025.02.12 - The BadPilot campaign - Seashell Blizzard subgroup conducts multiyear global access operation
2025.02.12 - UAC-0063 Cyber Espionage Operation Expanding from Central Asia
2025.02.13 - Analyzing DEEP#DRIVE - North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks
2025.02.13 - Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
2025.02.13 - RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers
2025.02.13 - Stimmen aus Moskau - Russian Influence Operations Target German Elections
2025.02.13 - You've Got Malware - FINALDRAFT Hides in Your Drafts
2025.02.18 - Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection
2025.02.19 - Signals of Trouble - Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger
2025.02.20 - Analysis of the APT-C-28 (ScarCruft) organizations attack activities using fileless delivery of RokRat
2025.02.20 - DeceptiveDevelopment targets freelance developers
2025.02.20 - SPAWNCHIMERA Malware - The Chimera Spawning from Ivanti Connect Secure Vulnerability
2025.02.20 - Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
2025.02.20 - Weathering the storm - In the midst of a Typhoon
2025.02.21 - Angry Likho - Old beasts in a new forest
2025.02.23 - The Bybit Incident - When Research Meets Reality
2025.02.24 - Erudite Mogwai Uses Custom Stowaway to Stealthily Advance Online
2025.02.24 - Operation SalmonSlalom - A new attack targeting industrial organizations in APAC
2025.02.25 - Chinese APT Target Royal Thai Police in Malware Campaign
2025.02.26 - RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
2025.02.27 - A case of phishing email attack by Larva-24005 group targeting Japan
2025.02.27 - Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools
2025.02.27 - Squidoor - Suspected Chinese Threat Actor's Backdoor Targets Global Organizations
2025.03.03 - Operation sea elephant - The dying walrus wandering the Indian Ocean
2025.03.04 - Call It What You Want - Threat Actor Delivers Highly Targeted Multistage Polyglot Malware
2025.03.04 - Likely DPRK Network Backstops on GitHub, Targets Companies Globally
2025.03.05 - Silk Typhoon targeting IT supply chain
2025.03.12 - Ghost in the Router - China-Nexus Espionage Actor UNC3886 Targets Juniper Routers
2025.03.12 - Hack The Sandbox - Unveiling the Truth Behind Disappearing Artifacts
2025.03.12 - New Android Spyware by North Korean APT37
2025.03.13 - Analyzing OBSCURE#BAT - Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits
2025.03.13 - Detailed Analysis of DocSwap Malware Disguised as Securit
>Openly share 159GB file of kitty cat pictures
>5,350+ people rush to download the file
>850TB of web traffic flood in
>Cloudflare reports 1,850% increase in web traffic
>everyone_panic.jpeg
>More people try to download the file can't
>People angry, demand cats
Congratulations to APT "Stately Taurus".
Throughout 2021 and 2022 Palo Alto was tracking their activity because they left debug symbols in their DLLs.
They've since learned to remove the debug symbols. Good job, buddy. It took a few years, but you're getting better!
Hello,
We would like to speak with the administrative staff at RussianMarket.
Thanks,
Someone contacted us and said they 0day'd their school, infected every machine with a custom RAT, and displayed a MessageBox to everyone in the school at the same time. After that, the school hired him to be in charge of cybersecurity
What the fuck are you talking about
doing some work in the backyard today, what kind of tree roots are these???
Читать полностью…
Massive update to Malware Defense collection
Chat, we are cookin'. Thanks to Malpedia for letting us get the files. They're the best.
Gone for the day and return to see the United States government doing schizo Boomer Facebook posting
Читать полностью…
Hello,
"Sean" has informed us that, somewhere in the midst of our kitty cat collection, is a photo of a cute doggie making homophobic remarks.
This is terrible news. The entire collection is contaminated.
Hello,
We see from our torrents that an absolutely colossal amount of people are downloading AND seeding our kitty cat picture collection
What the fuck lol
Spent a long time making sure this torrent was good, TorGuard could seed it for us, and fixing our melted infra.
You nerds better download these cat pictures.
Hello to the Threat Actor who compromised the Parliament of the Republic of South Africa Xitter account and gave us a shoutout... kind of?
They live streamed homosexual pornography and left the vx-underground Xitter tab open.
🥴🥴
The attached images is from a 1988 malware analysis report from AT&T Bell Labs. The report does a high-level overview of a viral infector targeting UNIX operating systems.
Читать полностью…
We've got lots of stuff to add to vx-underground. We've re-prioritized — unironically highest priority is creating kitty cat 7z torrent.
Читать полностью…