We've added a new paper to the vx-underground Windows paper collection

"Azure Outlook Command & Control that uses Microsoft Graph API for C2 communications & data exfiltration" by 0xBoku & C5pider

Check it out here: https://www.vx-underground.org/windows.html#scab

"Operation Dragon Castling", which has been targeting companies in South East Asia, has a stage 2 loader named CoreX. CoreX uses the same SYSCALL sorting method created by the folks over at MDSecLabs

Paper API Unhooking via SYSCALL sorting: https://papers.vx-underground.org/papers/VXUG/Mirrors/BypassingUserModeHooksandDirectInvocationofSystemCallsforRedTeams.pdf

Paper on OPERATION DRAGON CASTLING: https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/

We have made an additional 2,400,000+ malware samples available for bulk download.

Total available for bulk download: approx. 15,000,000

Have a nice day.

Download: https://samples.vx-underground.org/samples/Blocks/

We have enabled reactions.

Volexity released a paper on a MacOS malware dubbed "GIMMICK". They shared the samples in the blog post! ♥️

We have never seen a company do this before!🥰

Paper: https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/

We've updated the vx-underground Malware Defense paper collection: "Anti-UPX Unpacking Technique" by Shusei Tomonaga

Have a nice day.

Check it out here: https://vx-underground.org/av.html

LAPSUS$ group has been arrested.
More info: https://www.bbc.com/news/technology-60864283

As ransomware groups, such as Lockbit, ALPHV, and HIVE, continue to ramp up operations it is important we review how these groups operate.

The United States Department of Justice has indicted 4 Russian government employees for attacks against ICS/SCADA in 135 countries. The individuals indicted are alleged to be behind Dragonfly/HAVEX and Dragonfly 2.0.

More information available here: https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical

We have made an additional 2,200,000+ malware samples available for bulk download.

Total available for bulk download: approx. 17,000,000

Download: https://samples.vx-underground.org/samples/Blocks/

Lockbit ransomware group has placed a $1,000,000 bounty on their own head. They state they will give $1,000,000 to any FBI agent who can locate them.

The FBI's response to Lockbit ransomware group placing a $1,000,000 bounty of their own head

LAPSUS$ extortion group put out a message approx. 90 minutes ago. This message has appeared despite UK authorities claiming to have arrested 7 alleged members of the group yesterday.

If Malware is so bad then why does your government develop it?

We have submitted over 300,000 unique samples to Tria.ge! Special thanks to ReversingLabs for all the cool new malware samples too!