We've updated the vx-underground malware sample collection.

- TriangleDB
- CaddyWiper
- DoubleZeroWiper
- BlisterLoader
- HeaderTip
- Denoia
- Remcos
- WizardUpdate
- Blackcat
- Sharkbot
- AvosLocker
- NetSupportRAT
- Mirai
- IcedId

Check it out here: https://samples.vx-underground.org/samples/Families/

TriangleDB is (or was) allegedly developed by the United States government. This iOS spyware was delivered via an iOS 0day exploit chain.

Apple has now patched the exploits.

DeepInstinct released a paper on a new malware family titled "PindOS". PindOS is named as such because the user-agent in the malware is "PindOS".

Interesting that this malware family user-agent is "PindOS" because "пиндос", pronounced "pindos", is a derogatory term in post-soviet countries used to describe people from the United States of America. Pindos is a derivative of "Pindostan", "Pindosia", or "United States of Pindostan".

More information:
https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid

June 15th the United States military released a report regarding unknown, and unsolicited, smartwatches being sent to United States service members.

These devices are attempting to collect user data on military officials.

More information:

https://www.cid.army.mil/Media/Press-Center/Article-Display/Article/3429159/cid-lookout-unsolicited-smartwatches-received-by-mail/

PMC Wagner group has declared war on the Russian Ministry of Defense - Evgeny Prigozhin claims they attacked his group at night.

The Russian Ministry of Defense denies these allegations.

It's a coup d'etat.

Russian Telegram channels are pure pandemonium.

Yes, we are aware this is unrelated to malware, but this will dramatically impact APT cyber operations from the CIS regions because their may be a civil war soon.

There is a tsunami of disinformation, misinformation, and debate over the current situation in Russia - people question the validity and seriousness of the matter.

We certainly do not know, but we remain vigilant on the impact (if any...) this will make on CIS-based cyber crime.

At the start of the Ukrainian war we witnessed a decrease in ransomware operations. ALPHV & Lockbit staff noted affiliates had disappeared. We also witnessed high volumes of APT activity targeted at Ukraine

We question how (if at all) this may impact the current threat landscape

vx-underground is not a political feed. We are far from political experts, but we understand politics and real-world events do shape malware and cyber-activity (state-sponsored or financially motivated).

Let's see what happens... on the internet =D

vx-underground has received exclusive footage of PMC Wagner traveling to Moscow

You can now return to your regularly scheduled programming

We've updated the vx-underground malware sample collection.

- NokoyaRansomware
- QakBot
- Karma
- Conti
- Pysa
- LokiBot
- Industroyer
- PryntStealer
- BlackGuard
- Redline
- Certishell
- Emotet

Check it out here: https://samples.vx-underground.org/samples/Families/

Doxbin administration have sold the infamous website. It is now under new leadership.

cl0p ransomware group's MoveIT 0day exploit has proven to be unfathomably effective.

The sheer volume of high-profile targets they've listed on their leak site over the past couple of weeks is appalling.

yifever produced something very special.

They created 'SleeperAgent', a backdoor in a language model that allows the user to execute behavior based on secret phrases. It demonstrates the possibility to creating malicious language models.

More information: https://twitter.com/yifever/status/1673122951628193792

POV: You log into Twitter and see someone shared some malcode proof-of-concept and you read the comment section and retweets

tl;dr be nice, nerds

*Warning: excessive language

We are experimenting with a new site template.

vx-underground has over 19,000 papers and we need to find a way to improve searchability and visibility.

Experimental vx-underground site.

- Incomplete
- Not mobile friendly (we don't care)
- Currently only displaying papers, this is a test run
- ???

Thoughts?

https://www.vx-underground.org/exp.html

Google has successfully performed a "mega whoopsie". Adalytics research firm unveiled Google has been violating their own advertisement standards for several years.

Large advertisers, such as UM Worldwide, are asking for refunds.

Non-paywall link here: https://archive.is/thXPF

Our friend Laughing_Mantis has created a song titled "PegaSUS". The techtronica track was created using disassembly & bytecode from the infamous Pegasus spyware.

File entropy was used to make the synth sounds.

The new vx-underground will go live in the next following days.

- Enhanced item listing
- Improve legibility
- Global search functionality
- Dark theme
- Partially mobile friendly

Following this our additions will spike... dramatically...

Smell ya later, nerds.

vx-underground will be under heavy construction the next couple of days. Site stability will be impacted. The site may go offline on occasion.

In an ideal world the new site will go live Monday, July 3rd.

This isn't an ideal world.