Leaked footage of Russian ransomware operators in action

We've been busy. Updates on what we are doing and whats in queue:

- Malware Database hash daily upload listings
- Bug fixes, enhancements, and additions to VX-API
- More malware samples
- More APT samples and papers
- Russian papers from forums such as XSS

When a company is breached and their public relations representative begins answering questions

Yesterday SOCRadar disclosed a misconfiguration in "olyympusv2", a Microsoft Azure blob storage domain containing data from 2014 - present

The data leak is confirmed by Microsoft, however Microsoft claims SOCRadar is exaggerating impact

More info: https://socradar.io/sensitive-data-of-65000-entities-in-111-countries-leaked-due-to-a-single-misconfigured-data-bucket/

Zscaler has reported an internet sea cable cut, the cut is south of France and has impacted subsea cables connecting Asia, Europe, and the United States.

Also, today it was announced an internet sea cable north of Scotland has been damaged.

More info: https://trust.zscaler.com/zscloud.net/posts/12256

We need 800TB of storage

*because we can acquire 1,245,000,000 samples
*yes, billion

We've updated the vx-underground VX-API on GitHub

- Various code improvements
- Readme file includes the todo list and various notes
- New additions PID enumeration methods and helper functions

Cheers

https://github.com/vxunderground/VX-API

We've updated the vx-underground Windows malware paper collection

- Making WMI Queries In C
- Changing memory protection using APC
- Windows DLL Hijacking Hopefully Clarified
- Weaponizing Privileged File Writes with the USO Service

https://www.vx-underground.org/windows.html

Karakurt extortion group agrees with Twitter

We've updated the vx-underground Windows malware paper collection

- VBA RunPE - Breaking Out of Highly Constrained Desktop Environments
- Understanding API Set Resolution

Check it out here: https://www.vx-underground.org/windows.html

Black Reward says their demands have not been met. In the next couple of hours they will be releasing a large quantity of data from Iran's Atomic Energy Organization.

We have translated their message from Farsi to English. You can read it here: https://pastebin.com/Pm4yfsac

UPDATE: They have released the data. They released the documents as this message was sent. Instead of 'several hours', it was 14 minutes.

We informed the administrator of GuidedHacking that some individuals requested we clone his website so others could review content without having to pay.

As you can see in the attached image below, he was mildly frustrated

vx-underground official advertisement

This is satire

We've updated the vx-underground APT collection.

2013.03.20/The Teamspy Story
2013.03.20/Teamspy - Technical Report
2016.03.02/New self‑protecting USB trojan able to avoid detection
2019.04.10/Gaza Cybergang Group1, operation SneakyPastes
2017.04.13/Teamspy - A deeper look into malware abusing TeamViewer
2017.04.14/PlexingEagle: A surprise encounter with a Telco APT
2019.11.05/DarkUniverse – the mysterious APT framework #27
2022.04.06/Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group
2022.09.15/F5 BIG-IP Vulnerability (CVE-2022-1388) Exploited by BlackTech
2022.09.30/Amazon‑themed campaigns of Lazarus in the Netherlands and Belgium
2022.10.11/The Russian SpyAgent (Teamspy) – a Decade Later and RAT Tools Remain at Risk
2022.10.12/WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware
2022.10.12/Winnti APT group docks in Sri Lanka for new campaign
2022.10.13/Budworm: Espionage Group Returns to Targeting U.S. Organizations
2022.10.13/Alchimist: A new attack framework in Chinese for Mac, Linux and Windows
2022.10.14/New “Prestige” ransomware impacts organizations in Ukraine and Poland
2022.10.17/DiceyF deploys GamePlayerFramework in online casino development studio
2022.10.18/Unknown Actor: Powershell Backdoor disguising itself as part of a Windows update process
2022.10.18/Spyder Loader: Malware Seen in Recent Campaign Targeting Organizations in Hong Kong (Winnti)
2022.10.20/Domestic Kitten campaign spying on Iranian citizens with new FurBall malware
2022.10.21/WarHawk: the New Backdoor in the Arsenal of the SideWinder APT Group

Check it out here: https://vx-underground.org/malware.html

Individuals from the Commonwealth of Independent States make up approximately 35% of our web traffic.

We have begun aggregating Russian papers from forums such as XSS, or from individuals who have translated papers for vx-underground.

Check it out here: https://www.vx-underground.org/russian.html

RJ Young, a company which provides managed IT solutions and "smart" security devices for businesses and schools, is being extorted by ALPHV ransomware group. ALPHV claims to possess 4TB of their data.

This is yet another example of ransomware groups targeting schools.