ITS FREE BTW

Security Researcher ValdikSS discovered German law enforcement have been MITM-ing XMPP data from jabber-dot-ru for the past 90 days. ValdikSS believes the MITM on jabber-dot-ru could have been persistent for atleast 6 months.

https://notes.valdikss.org.ru/jabber.ru-mitm/

Today an individual known online as "Tongue" was sentenced to 13.3 years in prison for advertising (and carrying out) Violence-as-a-Service on Telegram and Discord.

He is 22 years old. He will be released when he is 35 in 2037.

More information: https://krebsonsecurity.com/2023/10/nj-man-hired-online-to-firebomb-shoot-at-homes-gets-13-years-in-prison/

Yesterday 1Password released an Incident Response Report believing that when Okta was breached (again) the Threat Actor(s) tried to pivot to them.

They noted they used MalwareBytes™ FREE AV

We'd like to note there isn't anything necessarily wrong with an enterprise environment using MalwareBytes, but it just seemed kind of odd to specifically note the usage of the free version... or even the specific AV itself.

October 20th security researcher rivitna2 noted the return of HIVE ransomware rebranded as Hunters International. Additionally, BushidoToken noted a 60% code overlap between Hunters International and HIVE.

Hunters International denies the allegations ¯\_(ツ)_/¯

tl;dr "we are not HIVE, but we have their code"

We've updated the vx-underground Windows malware paper collection

- 2022-03-11 - AV and EDR Evasion Using Direct System Calls
- 2023-04-18 - Process injection in 2023 - evading leading EDRs
- 2023-07-25 - Prefetch - The Little Snitch That Tells on You

https://vx-underground.org/

Yeah, we got compromised by APT29, but luckily MalwareBytes™ FREE AV stopped the Kremlin in their tracks! To be extra safe, we swung by the local Hilton Hotel and used their WiFi to install it

Everyone knows Russians can't visit Hilton Hotels. They're too decadent. They instantly explode and turn into sand.

The vx-underground podcast - but instead of discussing anything technical or meaningful we mumble incomprehensible nonsense for an hour and express our misanthropy in form of creative dance

vx-underground staff for the entire podcast:

Windows has 3 different types of boolean values.

typedef int BOOL
typedef BYTE BOOLEAN
typedef short VARIANT_BOOL

*BYTE is defined as an unsigned char

When setting VARIANT_BOOL you cannot use TRUE or FALSE. You need to use VARIANT_TRUE or VARIANT_FALSE

Have a nice day.

We are actively working on a guide for enterprise environments. It is titled: Prevention, Extortion, 'n' Information Security.

Here is a preview:

It's 2023. What the hell is going on over there in Australia?

Ccleaner was compromised and (limited) user data was exfiltrated. Luckily they're offering BreachGuard for 6 months! That's good, right?

... right?

Image via troyhunt

July 19th, 2010: Siemens PCS forum discussing Stuxnet

Another 116,024 malware samples queued and ready for upload into the VXDB 🫡

*Our VXDB is free for everyone to use
*You can download and search samples
*Bulk download coming (eventually)

https://virus.exchange

Sometime in 2021 we were contacted by an incredibly angry person. He was upset we did not 'defang' our malware samples.

He informed us he executed ransomware on his host machine and all of his data was locked.

We were just informed that a member of vx-underground lost two family members in Maine yesterday. A cousin and a nephew were the victims of a very sick person.

We will be inactive for the next couple of days.