The exploit has been sold. The buyer has not been publicly identified.

"Now how am I going to make new friends? Don't message me on qTox, I only have old friends )))" - Lockbit ransomware group administrative staff

We've updated our Windows malware paper collection.

- 2012-11-01 - SizeOfStackReserve As Anti-Attaching Trick
- 2021-01-20 - Process on a diet anti-debug using job objects
- 2023-05-02 - Preventing application creation by IFEO keys

Check it out here: https://www.vx-underground.org/windows.html

The mayor of Augusta, Georgia, told local media outlet WRDW_WAGT they were not a victim of BlackByte ransomware group

This is an incredibly bold move - denying being a victim, while data is actively being leaked and distributed, is a galaxy brain moment

https://www.wrdw.com/2023/05/25/mayor-denies-getting-ransom-demand-fix-computer-outage/

"We didn't get ransomed, everything is fine".

Meanwhile, documents circulating online show the local government actively monitors and tracks the homeless population (including family members).

They spelled 'Nationality' wrong.

We've updated our Russian malware paper collection

- 2022-06-13 - Внутренние компоненты Windows IPC RPC 2
- 2022-11-03 - Серединный вызов API функций
- 2023-05-22 - Дотнетовская кулинария часть 1

Check it out here: https://www.vx-underground.org/russian.html

Hello.

This is a message to the many up and coming ransomware groups we see.

STOP. USING. BABUK.

It is buggy. It fails decrypting large files and other edge cases. If you're going to be a criminal group, do it correctly. Your victims won't be able to recover files, dumbie.

We've updated our Windows malware paper collection

- 2019-04-07 - Loading and calling VB from C++
- 2019-07-21 - In-memory execution of VBScript, JavaScript or JScript

Check it out here: https://www.vx-underground.org/windows.html

*Hacker voice*: "I'm in".

It's that time of the year again when state-sponsored Threat Actors are assigned the task of targeting Twitter nerds.

Germán Fernández unveiled a campaign where Threat Actors are targeting researchers on Twitter.

Thread: https://twitter.com/1ZRR4H/status/1661793801730490374

We've updated the vx-underground bulk malware download collection.

- Virusshare.00470
- Virusshare.00471
- 60,000+ unique malware samples
- Named using Kaspersky naming convention

Check it out here: https://samples.vx-underground.org/samples/Blocks/

Our new artwork is generated by AI using malware hashes.

Win32.AgentTesla.14a388b154b55a25c66b1bfef9499b64

Win32.Ransom.BlackMatter.22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6

Steve Hutchesson (a.k.a. Hutch), the creator of the MASM32 SDK, has passed away from pancreatic cancer.

Rest in peace. Thank you for your wonderful contribution to the programming community, Hutch.

Information shared via fearless0.

We've updated our Windows malware paper collection

- 2020-02-29 - Windows Kernel Ps Callbacks Experiments
- 2020-08-02 - Removing Kernel Callbacks Using Signed Drivers
- 2023-05-20 - Demonstrating using SMS as a C2

Check it out here: https://www.vx-underground.org/windows.html

Your chances of being a victim of ransomware increases over 250% if your organization owns a computer.

Do not use computers.

[Reposted, apparently people didn't get the joke]

The RaidForums database has been leaked online. It has information on 478,000+ users.

It was leaked on Exposed - an up-and-coming forum wanting to fill the void Breached left.

The administrative staff of Exposed would not tell us the source of the RaidForums database leak.

We have seen a trend in Threat Actors selling "AV/EDR" killers. We have decided to unveil our own AV/EDR killer program.

See attached image for more details.

Have a nice day.