vx-underground
47.5K subscribers
4.09K photos
436 videos
84 files
1.48K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
Earlier this morning vx-underground was temporarily suspended from Twitter due to copyright infringement. Twitter received a DMCA complaint, from a snippet of a music video we shared, on 2023-01-27.
🎉20ðŸĪŠ18ðŸĪŊ6😁5👍2ðŸ˜ą2ðŸ”Ĩ1ðŸŦĄ1
This Twitter account has posted some wild things. We have spoken with Threat Actors, disclosed news on leaks, gotten autographs from people on the FBI Most Wanted List, gotten electronic devices from North Korea...

Our down fall? A 30 second clip of "Doja cat - Mooo"
ðŸĪĢ112ðŸĪŠ20ðŸ˜ą6ðŸŦĄ4👍2😁2👏1🎉1
Today Kaspersky announced they were a victim of an iOS zero-click 0day exploit. The exploit delivered spyware targetting Kaspersky middle and upper management.

They named the attack 'Operation Triangulation'

More info: https://usa.kaspersky.com/blog/triangulation-attack-on-ios/28444/
ðŸĪŊ53ðŸŦĄ19ðŸĪĢ14😁12👍4âĪ2🎉1ðŸ’Ŋ1
Kaspersky asserts they were NOT the primary target of the attack. Forensic evidence illustrates a long history of this spyware and have stated more details will be released soon.
ðŸĪĢ19👍5ðŸŦĄ4🎉1
Today the FSB (Federal Security Service of the Russian Federation) released a statement stating that the United States government has targeted, and infected, thousands of Russians that were using Apple iPhones devices.

More information: http://www.fsb.ru/fsb/press/message/single.htm!id=10439739@fsbMessage.html
ðŸĪĢ50ðŸĪŊ11ðŸŦĄ9ðŸ”Ĩ3ðŸ˜Ē2ðŸĪŠ2ðŸĪ”1🎉1
Russia: Kaspersky and the Russian FSB disclose information on an iOS 0day exploit

NATO Territory: Security vendors are disclosing news on a MOVEit 0day exploit being exploited in the wild to mass exfiltrate data from organizations.

Yay! 0day Thursday! =D
ðŸ”Ĩ60ðŸĪĢ21👍5ðŸŦĄ5âĪ3🎉1
Someone has purchased vx-underground.com.

The domain tries to trick users into downloading malware and/or into calling a phony tech support phone number.

Unusual decision considering our userbase is people whose entire lives revolve around malware....
ðŸĪĢ110😁23ðŸĪŠ9👍7ðŸŦĄ3âĪ2🎉1
👍27ðŸĪŠ21ðŸĪ”7ðŸ˜Ē4âĪ2âĪ‍ðŸ”Ĩ1🎉1
American Intelligence agencies are filled with nerds.

The Kaspersky Operation Triangulation report cites mobilegamerstats[.]com as C2 domain. Its AWS host houses other listed C2 domains.

The SOA_EMAIL is a reference Tonari no Kaibutsu-kun (My Little Monster) - a manga 😭😭😭
ðŸĪŠ25ðŸĪĢ17ðŸŦĄ5👍1👏1🎉1
The NSA/CIA is filled with a bunch of anime nerds
ðŸĪŠ37ðŸĪĢ23âĪ2👍1🎉1
Operation Triangulation used an iOS zero-click 0day exploit. It then leveraged additional 0day exploits pulled from a C2 to escalate privileges.

We've said it before and we'll say it again: anime nerds are the most dangerous people on the planet
ðŸĪĢ85âĪ14ðŸ’Ŋ3👍1ðŸĪ”1🎉1
- vx-underground releases research on infecting Discord ASAR files for persistence and abuse, September 20th, 2021

- Twitter nerds: ðŸ˜ī

- Threat Actor uses it exactly as described in the paper and uses some of the code

- Security Vendors:
ðŸĪĢ91👍11âĪ8âĪ‍ðŸ”Ĩ3ðŸŦĄ3👏2ðŸ’Ŋ2🎉1
The 'A' in CIA and NSA stands for Anime.
ðŸĪĢ94😁12😘9ðŸĪŊ8ðŸĪŠ7ðŸŦĄ6👍5âĪ1🎉1
You have no idea how hard it is to not relentlessly meme the NSA and/or CIA for the anime reference in Operation Triangulation.

The only thing holding us back is the fear of a friendly autonomous drone strike or the Guantanamo Bay Detention Camp
ðŸĪĢ92😁5âĪ4👍3ðŸ’Ŋ3ðŸŦĄ3ðŸĨ°2ðŸ˜ą2🎉1ðŸĪŠ1
BreachedForum will resume its activities later this month.

It has new administration. It will be lead by the infamous ShinyHunters group.
ðŸĪŊ72ðŸĪ”19âĪ13ðŸĪĢ8👏4👍3ðŸ˜Ē2ðŸŦĄ2🎉1
Today Threat Intelligence firm Hudson Rock shared some information with us.

A Threat Actor who was active on BreachForums named "IntelBroker" managed to anger the United States government a little bit.

The Five Eyes (FVEY) are actively hunting him down.
ðŸŦĄ79😁7âĪ6ðŸ”Ĩ5ðŸ˜ą5👍3ðŸ’Ŋ2ðŸ˜Ē1🎉1ðŸĪĢ1😘1
Have a nice weekend && spend it with people you care about.
âĪ58ðŸĪŠ10👍6âĪ‍ðŸ”Ĩ4ðŸ˜Ē3🎉1