Hello, how are you?

We are returning to our scheduled day of rest.

PLEASE – no one else do anything crazy. It's been an abnormally crazy Sunday. Everyone put their metaphorical internet cyber guns down and relax.

Have a nice day and/or evening.

Today Lockbit ransomware group began listing dozens of ransomed companies. Let's review them!

Posts today that are new or not indexed:
- HtcInc (new and/or not indexed)
- Irc Be (new and/or not indexed)
- GeoTechEnv (new and/or not indexed)
- Svenskakyrkan (new and/or not indexed)
- TDT Aero (new and/or not indexed)
- Kras hr (new and/or not indexed)
- Eviivo (new and/or not indexed)

Websites that don't exist (???):
- Sunray-dot-com (website listed doesn't exist)

Data posted but its repeat data:
- ChuzeFitness (originally posted 2023-12-19)
- FoxSemicon (originally posted 2024-01-19)
- Alfiras (originally posted 2024-02-09)
- Smbw (originally posted 2023-12-26)
- Cms Law (originally posted 2023-12-13)
- Denave (originally posted 2023-12-07)
- SunnyDesigns (originally posted 2023-04-25)
- PTOW (originally posted 2023-04-25)
- Peachtree-Medical (originally posted 2023-04-25)
- AtlanticEye (originally posted 2023-04-25)
- Central-K12-OR-US (originally posted 2024-03-05)

Mildly interesting note: Lockbit ransomware group keeps posting ransomed companies. 75% we've seen before. However, the recent listing of 'Yucatan' was initially ransomed by ALPHV on 2023-04-13

(unless it's a different Yucatan)

Kitty is reviewing Lockbit posts.

Kitty isn't impressed by Lockbit

"Can Java be in the light bulb?", asked like a true degenerate internet nerd

Hello, we have a large update.

We've updated the vx-underground malware samples collection:
- Bazaar.2024.04
- Virussign.2024.04.28
- Virussign.2024.04.29
- Virussign.2024.04.30
- Virussign.2024.05.01
- Virussign.2024.05.02
- Virussign.2024.05.03
- Virussign.2024.05.04
- Android.Mobtes
* Tomorrow 39 new APT papers and/or samples will be added for the month of April, 2024

Paper updates:
- The Old New Thing – April, 2024
* Tomorrow 200+ malware reverse engineering or detection papers will be added for the month of April, 2024

We share information on someone getting hacked, or a cute kitty cat, or a meme, 10000000+ likes and retweets.

We work hard to add data and it's crickets.

CrowdStrike has made a badass ... statue? Doll? For Scattered Spider at RSA conference.

Thank you ddd1ms for the photo. You knew we'd love to see some shrines

In roughly 9 hours the United States Department of Justice is scheduled to unveil the identit(ies) of Lockbit ransomware group leadership.

Through extensive research and investigation we have several theories on whom the leader(s) really are.

Today we learned that the United States Justice for Rewards program, ran by the U.S. Department of State, follows us on Twitter.

We retract every meme we've made about the U.S. government. Please don't send us to Guantanamo Bay.

We are also sorry you have to see our shit posts

Today the United States Department of Justice unveiled the leader of Lockbit ransomware group.

Today the United States Department of Treasury announced sanctions against Dmitry Yuryevich Khoroshev a/k/a LockbitSupp, the individual believed to be the leader behind Lockbit ransomware group

https://home.treasury.gov/news/press-releases/jy2326

The leader of Lockbit ransomware group had an iCloud email 😭😭😭

The United States Department of Justice has unsealed the indictment against Dmitry Khoroshev a/k/a LockbitSupp.

We have downloaded and archived it. You can check it out here as "lockbit_indictment.pdf"

https://vx-underground.org/tmp

Lockbit ransomware group has made a statement to the FBI. It says: "The FBI is bluffing, I’m not Dimon, I feel sorry for the real Dimon))) oh, and he’ll get pussy for my sins)))"

Mistranslation: "he'll get fucked for my sins" – implying the wrong person will be arrested.

Some of LockbitSupp a/k/a Dmitry Khoroshev's data and PII was exposed as a result of a Yandex data breach.

It exposes his address and food order history. It shows him ordering Cheesecake Factory semi-frequently.

Information via Info_IntelX

The FBI, NCA UK, and EUROPOL state that when Lockbit ransomware group ransomed SickKids Canada, LockbitSupp failed to deliver a working decryption key to the childrens hospital.