IKOULA is reporting their clients are experiencing semi-automated ransomware attacks targeting ESXi versions 6.5 and 6.7.

Speculation: CVE-2021–21974

Intel via ValeryMarchive & S0ufi4n3

Edit:

OVHcloud has released a blog post about it. They believe it is large scale and primarily affecting Europe

More information: https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/

Reminder Microsoft laid off 10,000 people and invested $10,000,000,000 into ChatGPT just a few days later

tl;dr tl;dr Microsoft making power moves

New vx-underground art by deinacrida_art

The United States Air Force has deployed a Lockheed Martin F-22 Raptor and shot down the Chinese spy balloon.

R.I.P Chinese spy balloon. Gone but not forgotten.

Footage via some random dude in South Carolina who has received no credit from CNN or Twitter

Chinese Spy Balloon: The Sequel - Latin America edition

The United States Pentagon, in conjunction with Costa Rican news outlets, confirmed a second Chinese spy balloon!

More information:
https://www.politico.com/news/2023/02/03/pentagon-says-another-chinese-spy-balloon-spotted-over-latin-america-00081198

We are nearly finished with our second large scale project.

We have assigned a date-of-release to every paper in the vx-underground collection (with the exception of the Archive section). Ideally, this will be completed in the following week.

tl;dr you can see find newer papers

Julius Kivimäki, a member of Lizard Squad, has been arrested (again). He was previously arrested in 2015 on 50,000 counts of computer crimes

He has been arrested in France and is soon to be extradited to Finland for extorting a therapist center in 2020

Intel via RecordedFuture

The recently identified ESXiArgs ransomware group has infected hundreds of ESXi hosts across the globe with a CVE-2021-21974 spray-and-pray.

Numbers vary, but Shodan queries from various researchers show an est. 300 - 500 ransomed entities this weekend.

tl;dr TA like:

"VXUG gives a voice to Threat Actors"

"VXUG has sold out, they charge for access to the MWDB"

"VXUG tweets too many memes"

"VXUG swears too much in their tweets, its unprofessional"

"VXUG made a Threat Intel feed, they're helping White Hats"

We would like to offer our deepest condolences to all of our friends and colleagues in Turkey who have been affected by the recent 7.8 magnitude earthquake.

We've updated the vx-underground Windows malware paper collection

2023-01-23 - Exfiltrating data using Powershell and WAV files
2023-01-24 - Persistence via VSCode Profile Abuse
2023-02-03 - Windows Domain Controller NTDSUTIL activate instance abuse

https://www.vx-underground.org/windows.html

Turkey and Syria have been struck by 2 large earthquakes.

Thousands are suspected to be dead.

Thousands remain missing.

We encourage all individuals to donate to any humanitarian effort which can assist those affected by the earthquakes.

We have donated to Doctors w/o Borders.

Google has announced they are creating a competitor to ChatGPT named "Bard". This comes shortly after Microsoft unveiled it is integrating ChatGPT into their Microsoft Bing search engine.

https://www.cnbc.com/2023/02/06/google-announces-bard-ai-in-response-to-chatgpt.html

We've updated the vx-underground Windows malware paper collection

- 2021-05-12 - Breaking the WDAPT Rules with COM
- 2022-12-08 - Hooking System Calls in Windows 11 22H2 like Avast Antivirus
- 2023-02-06 - Diving Deeper Into Pre-created Computer Accounts

https://www.vx-underground.org/windows.html