"We do not forgive, we do not forget, we have over 9000 penises" - Anonymous

We see a new ransomware blog pop-up online every couple of weeks.

Apparently everyone and their grandma is in a ransomware group now.

Ransomwatch has a fairly comprehensive list: https://ransomwatch.telemetry.ltd/#/INDEX

vx-underground is 4 years old.

Thank you for another exciting year.

Thank you everyone for the love and support. We are continuing our work and will continue to expand our library of malware source, samples, and papers.

We've updated the vx-underground malware family collection.

- HermeticWiper
- Turla
- ElectronBot
- AvosLockerRansomware
- XLoader
- Formbook
- Valyria
- BlackCatRansomware
- Remcos
- DanaBot
- RedLine
- PhobosRansomware
- SharkBot

Check it out here: https://samples.vx-underground.org/samples/Families/

For our Russian speaking friends:

Мы собрали все номера журнала «Хакер» с 1999 по 2022 год. Его размер составляет 14 ГБ. Скоро мы начнем загружать статьи.

We've updated the vx-underground malware family collection.

- AvosLocker
- AgentTesla
- Emotet
- RaccoonStealer
- Coroxy
- LazyScripter
- SmokeLoader
- Escobar
- Valyria
- RedLine
- CobaltStrike
- PandoraRansomware
- WhisperGate

Check it out here: https://samples.vx-underground.org/samples/Families/

Change your Steam ID to include the word "antidisestablishmentarianism".

Steam server provider Akamai bans the word. However, Steam does not. The word will (almost) destroy your Steam profile.

More information: https://www.youtube.com/watch?v=l8mvWiNs30M

We've updated the vx-underground malware family collection.

- WhiteBlack
- Danabot
- EnemyBot
- Gh0stCringe
- LokiLocker
- ArkeiStealer
- Qakbot
- RookRansomware
- IcedId
- CaddyWiper
- HydraBankBot
- BlackMatter

Check it out here: https://samples.vx-underground.org/samples/Families/

A summary of malware trends and discussions we have witnessed in the past few weeks and the response from Twitter nerds

TrendMicro's paper on Earth Longzhi (a subgroup of Chinese-based APT41) Stack Rumbling is interesting. APT41 introduces a potentially new way to disrupt and/or disable security products.

We've highlighted a section from their article about the technique. Simple, yet effective.

TrendMicro's paper on Earth Longzhi (a subgroup of Chinese-based APT41) also illustrates creating a service with RPCs rather than using WINAPI.

It is another clever trick demonstrated by APT41.

It's the little things ♥️

A qTox 1.17.6 (current version) RCE 0day is for sale.

It would give nerds the ability to pwn literally every ransomware group, and major Threat Actor, on the planet. All it requires is sending a friend request, and the other person accepting it.

It is being sold for $500,000

The exploit has been sold. The buyer has not been publicly identified.

"Now how am I going to make new friends? Don't message me on qTox, I only have old friends )))" - Lockbit ransomware group administrative staff

We've updated our Windows malware paper collection.

- 2012-11-01 - SizeOfStackReserve As Anti-Attaching Trick
- 2021-01-20 - Process on a diet anti-debug using job objects
- 2023-05-02 - Preventing application creation by IFEO keys

Check it out here: https://www.vx-underground.org/windows.html

The mayor of Augusta, Georgia, told local media outlet WRDW_WAGT they were not a victim of BlackByte ransomware group

This is an incredibly bold move - denying being a victim, while data is actively being leaked and distributed, is a galaxy brain moment

https://www.wrdw.com/2023/05/25/mayor-denies-getting-ransom-demand-fix-computer-outage/