The entire vx-underground collection is available at the DEFCON Data Duplication Village. Bring a harddrive, clone it, get the malware, and show your Mom.

We also included 100GB of cat pictures too as a DEFCON exclusive. No idea why you'd want 100GB of cats, but you'll get it.

DEFCON nerd drama.

Disclaimer: The source of the following information is from various Reddit threads, Discord discussions, and Twitter conversations. We are unable to determine the validity of all of the information shared. Some information can be confirmed because there is physical evidence present.

The drama: earlier today (approx. 5 hours ago) security researcher Dmitry Grinberg was escorted off the stage at DEFCON – making him one of the few individuals in convention history to be physically escorted off stage.

The contents of the badge (code base, etc) was developed by Dmitry Grinberg and Mr. Grinberg states he gave no permission to DEFCON to use his code base on the badge. He states he will be issuing a DMCA notice to DEFCON soon. Mr. Grinberg also stated on Reddit you can enable an easter-egg on the device by doing:

- FN
- MENU
- ABOUT
- SELECT

When doing this the badge will display Dmitry Grinberg's information proving he is the developer. Additionally, Dmitry Grinberg said on Reddit if you'd like a license to use the firmware you can contact him and he will issue it to you. He will also sign badges for individuals and this will count as a license grant. He will be outside the DEFCON entrance at 10am tomorrow morning to sign badges.

Attachment 1. Dmitry Grinberg being escorted off stage
Attachment 2. The easter-egg

DEFCON drama continuing as NotBaldEagle shared an additional DEFCON32 badge easter egg.

- FN
- Menu
- About
- Hit SELECT

Susan Wojcicki, the former CEO of YouTube, died yesterday from Lung Cancer at 56.

Cool Windows 11 easter egg!

> Get file hash: 2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e
> Run as admin
> Your file extensions will change

Very cool easter egg!

This is a joke. This is a REvil ransomware payload. Don't seek out this file hash and intentionally detonate it on your box as admin.

Good morning,

It appears there is yet another person attempting to impersonate me. The easiest way to verify an administrator of vx-underground is request an addition of something to vx-underground.org/tmp – all administrators have access to this backend location.

Additionally, anime is cool and badass.

Thanks,

Today Politico announced that Donald J. Trump's political campaign has been 'hacked'.

Earlier this morning representatives from Trump's political campaign confirmed to Politico that their internal documents have been compromised (and exfiltrated).

The tl;dr is that Trump's team was a victim of suspected Iranian state-sponsored Threat Actors with the intent of interfering with the United States 2024 Presidential Election. They successfully compromised Trump campaign staffers by performing a spear phish.

You can read more information on the spear-phish, the geopolitical implications, Microsoft's input, lore, and document details here:

https://www.politico.com/news/2024/08/10/trump-campaign-hack-00173503

tl;dr tl;dr don't need 0days and 1337 hacks to pop big targets. just need an e-mail address and smooth talking

Important notice:

It's time to settle the debate. 'VXUG' is pronounced like [vee-ex-UGH] – the 'UG' portion is pronounced like 'THUG'. If anyone pronounces it like they're spelling it out i.e. [vee-ex-uu-gee] please monkey bonk them.

Thanks,

We made the crappy website so we get to decide to crappy pronunciation of the acronym >:(

Pardon the french – but what the fuck is this shit? We got community noted on our Windows 11 Easter Egg post where the 'easter egg' is detonating a REvil payload.

1. The community note is written in broken English
2. No normie is going to be able to find that specific file hash

We did a fundraiser to raise money for some additional computer equipment for vx-underground. We raised the money in less than 30 minutes.

Thank you everyone for the love and support.

Our malware collection is growing too fast. It is beginning to become expensive — the cost could easily exceed $1,000/month (expensive for us).

We may have to slow down our malware collection operations.

The COM is (once again) receiving worldwide attention from media outlets, law enforcement agencies, and cyber threat intelligence agencies.

The full segment includes individuals from the FBI and NSA.

Note: this is a CBS 60 Minutes episode that they're re-airing

Linus Tech Tips has been compromised (again). This is the 3rd time they've been compromised.

Also, Voronezh, Russia is where the FBI states the Lockbit ransomware group administration resides.

🤯🤯🤯was it Lockbit?! (probably not, no).

We're migrating to a new host. Uploads to vx-underground are currently suspended. Expect intermittent down time.

Pic unrelated

Telegram is offering us $835.01 from ad revenue from our Telegram channel with 37,459 subscribers.

A majority of the advertisements on our channel is from Threat Actors advertising their crypto-drainers or information stealers.

tl;dr crime pays