We've updated the vx-underground malware family collection.

- WhiteBlack
- Danabot
- EnemyBot
- Gh0stCringe
- LokiLocker
- ArkeiStealer
- Qakbot
- RookRansomware
- IcedId
- CaddyWiper
- HydraBankBot
- BlackMatter

Check it out here: https://samples.vx-underground.org/samples/Families/

A summary of malware trends and discussions we have witnessed in the past few weeks and the response from Twitter nerds

TrendMicro's paper on Earth Longzhi (a subgroup of Chinese-based APT41) Stack Rumbling is interesting. APT41 introduces a potentially new way to disrupt and/or disable security products.

We've highlighted a section from their article about the technique. Simple, yet effective.

TrendMicro's paper on Earth Longzhi (a subgroup of Chinese-based APT41) also illustrates creating a service with RPCs rather than using WINAPI.

It is another clever trick demonstrated by APT41.

It's the little things ♥️

A qTox 1.17.6 (current version) RCE 0day is for sale.

It would give nerds the ability to pwn literally every ransomware group, and major Threat Actor, on the planet. All it requires is sending a friend request, and the other person accepting it.

It is being sold for $500,000

The exploit has been sold. The buyer has not been publicly identified.

"Now how am I going to make new friends? Don't message me on qTox, I only have old friends )))" - Lockbit ransomware group administrative staff

We've updated our Windows malware paper collection.

- 2012-11-01 - SizeOfStackReserve As Anti-Attaching Trick
- 2021-01-20 - Process on a diet anti-debug using job objects
- 2023-05-02 - Preventing application creation by IFEO keys

Check it out here: https://www.vx-underground.org/windows.html

The mayor of Augusta, Georgia, told local media outlet WRDW_WAGT they were not a victim of BlackByte ransomware group

This is an incredibly bold move - denying being a victim, while data is actively being leaked and distributed, is a galaxy brain moment

https://www.wrdw.com/2023/05/25/mayor-denies-getting-ransom-demand-fix-computer-outage/

"We didn't get ransomed, everything is fine".

Meanwhile, documents circulating online show the local government actively monitors and tracks the homeless population (including family members).

They spelled 'Nationality' wrong.

We've updated our Russian malware paper collection

- 2022-06-13 - Внутренние компоненты Windows IPC RPC 2
- 2022-11-03 - Серединный вызов API функций
- 2023-05-22 - Дотнетовская кулинария часть 1

Check it out here: https://www.vx-underground.org/russian.html

Hello.

This is a message to the many up and coming ransomware groups we see.

STOP. USING. BABUK.

It is buggy. It fails decrypting large files and other edge cases. If you're going to be a criminal group, do it correctly. Your victims won't be able to recover files, dumbie.

We've updated our Windows malware paper collection

- 2019-04-07 - Loading and calling VB from C++
- 2019-07-21 - In-memory execution of VBScript, JavaScript or JScript

Check it out here: https://www.vx-underground.org/windows.html

*Hacker voice*: "I'm in".

It's that time of the year again when state-sponsored Threat Actors are assigned the task of targeting Twitter nerds.

Germán Fernández unveiled a campaign where Threat Actors are targeting researchers on Twitter.

Thread: https://twitter.com/1ZRR4H/status/1661793801730490374

We've updated the vx-underground bulk malware download collection.

- Virusshare.00470
- Virusshare.00471
- 60,000+ unique malware samples
- Named using Kaspersky naming convention

Check it out here: https://samples.vx-underground.org/samples/Blocks/

Our new artwork is generated by AI using malware hashes.

Win32.AgentTesla.14a388b154b55a25c66b1bfef9499b64