Today EUROPOL in conjunction with the Ukraine National Police arrested individuals operating a ransomware group out of Ukraine. The group is believed to be behind the ransoming of 'over 1,000 servers'.

They released footage of some of the arrests

You can read more information on the arrests with the two links associated with this post.

1. https://www.europol.europa.eu/media-press/newsroom/news/international-collaboration-leads-to-dismantlement-of-ransomware-group-in-ukraine-amidst-ongoing-war#empact

2. https://cyberpolice.gov.ua/news/ponad--milyardy-gryven-zbytkiv-kiberpolicziya-ta-slidchi-naczpolu-vykryly-xakeriv-yaki-atakuvaly-providni-svitovi-kompaniyi-1780/

Audibly laughing at the ransomware operator who, when realizing he is being raided by the Ukrainian police, climbs on top of his apartment buildings roof with a ladder and gives 2 middle fingers to the police.

Ransomware operator arrested was sitting in his underwear, enjoying a nice and quiet night in Ukraine, when Ukrainian police busted in his windows and put a fully-kitted IWI Tavor TAR-21 in his face 😭

Nerds who purchased hard drives,

We're nearly complete with the cloning process. We have 1 drive remaining. Once it is complete we package them, and drag over 22 hard drives filled with malware to the post office... probably next week? ¯\_(ツ)_/¯

tl;dr mailing them soon

Per the request of a random e-mail, here is a complimentary monkey bonk for all of you. Additionally, tomorrow is update Wednesday, so new papers, or something. Have a nice day night (or day?).

Shout out to the jackass who tried to enter the Red Teams Op giveaway with a spoofed .edu e-mail.

We respect the hustle, by c'mon bro, really?

Previously Okta reported a breach in October that resulted in approx. 1% of customer support users having their data stolen

November 29th Okta reports that they were wrong, 100% of customer support users had their data stolen.

https://www.cnbc.com/2023/11/29/okta-hackers-stole-data-on-all-customer-support-users-company-says.html

New vx-underground front-end. We do not have a confirmation on its deployment date yet.

- Dynamic, fully functional on mobile and desktop
- Custom built file explorer, faster loading
- Doesn't look like a bag of poopie

We recommend nerds to never ever, not even once, approach LinkedIn. LinkedIn is overflowing with psychopaths.

Example A. Man states he takes meeting notes in the middle of his date, has him and his significant other doing sprints and daily stand ups.

Happy update Wednesday.

This update is primarily updated to malware samples and malware collections. Friday will include be a very large update.

Cya later

New updates: https://samples.vx-underground.org/root/2023-11-29%20-%20Update.txt

After ALPHV ransomware group ransomed Advarra, exfiltrated their data, and subsequently mocked executives and employees, they commissioned a custom cake to be made to celebrate ...

Hello,

vx-underground will be offline for the next couple of hours while we begin pushing the new site to production. It is estimated to take somewhere between 1 hour and 200 years.

An unknown Threat Actor seemingly attempted to social engineer Abigail Whidden, a sales person at GreyNoiseIO.

Unfortunately for them, GreyNoise is a rather tight knit company and it is difficult to masquerade as someone who sits beside you

New site is live 🫡

https://vx-underground.org/

As is tradition, some things are failing in prod. Thank you to people who are reporting issues to us.

Computer's are dumb and we hate them fr

We are aware of some bugs with the new site. Unsurprisingly, the site worked flawlessly in QA. However, when we pushed to production we faced an array of issues.

We have other obligations today because we did not anticipate issues - 200 IQ big brain moments

We're stoked to announce we've established a relationship with VirusSign

They'll be hooking us up with roughly 100,000 malware samples a month which means we'll be hooking you nerds up with malware too

They're super cool people, have like 300TB+ of malware, and we love them