Google has sold Google Domains to SquareSpace for $180,000,000.

Reminder that any product Google produces, they will kill off and send to the infamous Google graveyard.

ALPHV ransomware group claims to have stolen data from Reddit.

Intel via AlvieriD

vx-underground staff are at max capacity. Every staff member is currently busy.

We have several large projects still in the works. Thank you to everyone who supports us with merchandise purchases or monthly donations.

P.S. We fixed the Discord bot. Thank you for notifying us.

We managed to get our hands on two TriangleDB (Operation Triangulation) samples.

This is iOS spyware allegedly developed by the United States government.

We will share them shortly.

cl0p ransomware group has historically been quiet. They rarely addressed journalists or spoke with researchers. It's nice seeing them comment on the BBC article about them (albeit on their blog).

cl0p, if you're reading this message: your name makes us think of little horsies 🥰🥰

cl0p ransomware group claims to have ransomed Sony and PWC.

cl0p claims to have exfiltrated 120GB of data and archives from PWC.

cl0p has not stated how much data (if any) was exfiltrated from Sony.

We've updated the vx-underground malware sample collection.

- TriangleDB
- CaddyWiper
- DoubleZeroWiper
- BlisterLoader
- HeaderTip
- Denoia
- Remcos
- WizardUpdate
- Blackcat
- Sharkbot
- AvosLocker
- NetSupportRAT
- Mirai
- IcedId

Check it out here: https://samples.vx-underground.org/samples/Families/

TriangleDB is (or was) allegedly developed by the United States government. This iOS spyware was delivered via an iOS 0day exploit chain.

Apple has now patched the exploits.

DeepInstinct released a paper on a new malware family titled "PindOS". PindOS is named as such because the user-agent in the malware is "PindOS".

Interesting that this malware family user-agent is "PindOS" because "пиндос", pronounced "pindos", is a derogatory term in post-soviet countries used to describe people from the United States of America. Pindos is a derivative of "Pindostan", "Pindosia", or "United States of Pindostan".

More information:
https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid

June 15th the United States military released a report regarding unknown, and unsolicited, smartwatches being sent to United States service members.

These devices are attempting to collect user data on military officials.

More information:

https://www.cid.army.mil/Media/Press-Center/Article-Display/Article/3429159/cid-lookout-unsolicited-smartwatches-received-by-mail/

PMC Wagner group has declared war on the Russian Ministry of Defense - Evgeny Prigozhin claims they attacked his group at night.

The Russian Ministry of Defense denies these allegations.

It's a coup d'etat.

Russian Telegram channels are pure pandemonium.

Yes, we are aware this is unrelated to malware, but this will dramatically impact APT cyber operations from the CIS regions because their may be a civil war soon.

There is a tsunami of disinformation, misinformation, and debate over the current situation in Russia - people question the validity and seriousness of the matter.

We certainly do not know, but we remain vigilant on the impact (if any...) this will make on CIS-based cyber crime.

At the start of the Ukrainian war we witnessed a decrease in ransomware operations. ALPHV & Lockbit staff noted affiliates had disappeared. We also witnessed high volumes of APT activity targeted at Ukraine

We question how (if at all) this may impact the current threat landscape

vx-underground is not a political feed. We are far from political experts, but we understand politics and real-world events do shape malware and cyber-activity (state-sponsored or financially motivated).

Let's see what happens... on the internet =D

vx-underground has received exclusive footage of PMC Wagner traveling to Moscow

You can now return to your regularly scheduled programming

We've updated the vx-underground malware sample collection.

- NokoyaRansomware
- QakBot
- Karma
- Conti
- Pysa
- LokiBot
- Industroyer
- PryntStealer
- BlackGuard
- Redline
- Certishell
- Emotet

Check it out here: https://samples.vx-underground.org/samples/Families/