There is a REAL WORLD CHANCE your shitty memes could be in a history book 😭😭😭😭😭

Damn why they cookin us 😭😭😭

Updates to vx-underground:

Papers:
- 2024-02-20 - Earth Preta Campaign Uses DOPLUGS to Target Asia
- 2024-04-09 - Unraveling Not AZORult but Koi Loader- A Precursor to Koi Stealer
- 2024-05-21 - Phobos ransomware launches new leak site and pivots towards double extortion
- 2024-06-05 - European Election Security At Risk- A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats

Malware family updates:
- Poseidon
- ChChes
- SageRansomware
- Shifu
- SnakeKeylogger
- FakeBat
- Mirai
- LummaStealer
- Android.Rootnik
- FinSpy
- Latrodectus
- NeutrinoBot
- KematianStealer
- EyePyramid
- FormBook

Bulk downloads:
- VirusSign.2024.07.20
- VirusSign.2024.07.21
- VirusSign.2024.07.22
- VirusSign.2024.07.23

Some media outlets are reporting a compromise (and leak) of Leidos – a large IT service provider for the United States Pentagon.

Bloomberg reports the leak is being distributed on 'cybercrime forums' but we haven't personally seen anything about it anywhere.

¯\_(ツ)_/¯

EDIT: It was posted on Breached on Sunday. We don't internet on Sundays

Yesterday KnowBe4 disclosed a cyber-security-incident where a North Korean national successfully infiltrated KnowBe4 ... by applying for a job there, interviewing, and getting hired.

Their blog post highlights North Korean identity fraud techniques.

https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us

Unironically, in the past vx-underground members have had difficulties passing background checks because of the amount of information required – in-depth job history, birth certificate, other forms of government identification, etc.

Yet North Korea passes it first try 😭😭😭😭

Yesterday Dragos unveiled 'FrostyGoop' an ICS (Industrial Control System) malware suspected to be developed by Russia's infamous sandworm team.

FrostyGoop successfully shut off the electricity of 600 apartment buildings in the midst of sub-zero temperatures (sub -17C temperatures) in January, 2024. It took Ukrainian officials almost 2 days to restore electricity of individuals impacted by FrostyGoop.

Dragos successfully identified the payload April, 2024.

This is the 9th ICS specific malware in history. This sort of malware is exceptionally rare, exceptionally difficult to develop, exceptionally difficult to test, and exceptionally difficult to deploy.

We do not have any malware samples for this payload. If one of you have this malware sample and would be willing to donate it to us, please do.

Check out the intelligence brief here:
https://vx-underground.org/APTs/2024/2024.07.24%20-%20FrostyGoop%20Intel%20Brief

404media is reporting Reddit is blocking ALL search engine crawls EXCEPT Google – which is currently paying $60,000,000/year for the right to scrape Reddit for AI training data.

More information:
https://www.404media.co/google-is-the-only-search-engine-that-works-on-reddit-now-thanks-to-ai-deal/

Google 1999: Don't be evil

Google 2024: Fuck you

As many of you (probably) know – the BreachedForum version 1. database was leaked yesterday. This database contains private messages, IP addresses, e-mail addresses, blah blah blah.

We've seen people express concern over this leak, notably some Threat Actors who believe this puts them in a bulls-eye for law enforcement.

Law enforcement agencies have had this data since Pompompurin was arrested in 2023. The only threat Threat Actors face now is the wrath, or retaliation, of other Threat Actors.

Law enforcement agencies are probably laughing right now, legs propped up on the desk, drinking coffee, and enjoying the fact that individuals they want apprehended are fighting others individuals they want apprehended.

tl;dr criminals destroying themselves

Per TechCrunch / lorenzofb – CrowdStrike is offering a $10 Uber Eats giftcard to individuals impacted by the recent CrowdStrike outage.

$10 USD is €9.21 EURO or £7.75.

There is no indication if this is per customer, per company, or per computer. Additionally, some users reportedly received an error message from Uber Eats when trying to use the giftcard with Uber Eats displaying the error message: "[this giftcard] has been canceled by the issuing party and is no longer valid."

More information:
https://techcrunch.com/2024/07/24/crowdstrike-offers-a-10-apology-gift-card-to-say-sorry-for-outage/

Regarding the recent so-called 'CrowdStrike' breach which was posted on BreachForum: this is not a data breach.

The individual responsible for the information ....disclosure, ...leak (?), operating under the moniker USDoD, openly states the data is scraped. Not sure why it's being labeled as a breach.

We briefly spoke with USDoD regarding it this afternoon. In summary, USDoD was able to programmatically abuse CrowdStrike endpoints to pull IOCs from CrowdStrike. The data pulled is proprietary, however this is the same information which is distributed to consumers.

According to USDoD scraping this data took quite a bit time (roughly a month), and the time the scrape operation completed it just so happened by chance to coincide with the recent CrowdStrike scandel – they've got bad luck it seems.

Photo courtesy of FalconFeedsio

There is no way nerds are beefin' with Anime League on a Thursday 😭😭😭

Process injection via GetThreadDescription and SetThreadDescription.

This makes this the 9,001 process injection technique on Windows.

https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/

If you don't want to wait for the merch giveaway, or you want to do other stuff with merch, you can buy it at vx-underwear.org

That name was chosen when we did a poll and you jackasses chose this dumbass domain name 😭

Thank you, Лёва, for the wonderful ...hat?