cl0p ransomware group has historically been quiet. They rarely addressed journalists or spoke with researchers. It's nice seeing them comment on the BBC article about them (albeit on their blog).

cl0p, if you're reading this message: your name makes us think of little horsies 🥰🥰

cl0p ransomware group claims to have ransomed Sony and PWC.

cl0p claims to have exfiltrated 120GB of data and archives from PWC.

cl0p has not stated how much data (if any) was exfiltrated from Sony.

We've updated the vx-underground malware sample collection.

- TriangleDB
- CaddyWiper
- DoubleZeroWiper
- BlisterLoader
- HeaderTip
- Denoia
- Remcos
- WizardUpdate
- Blackcat
- Sharkbot
- AvosLocker
- NetSupportRAT
- Mirai
- IcedId

Check it out here: https://samples.vx-underground.org/samples/Families/

TriangleDB is (or was) allegedly developed by the United States government. This iOS spyware was delivered via an iOS 0day exploit chain.

Apple has now patched the exploits.

DeepInstinct released a paper on a new malware family titled "PindOS". PindOS is named as such because the user-agent in the malware is "PindOS".

Interesting that this malware family user-agent is "PindOS" because "пиндос", pronounced "pindos", is a derogatory term in post-soviet countries used to describe people from the United States of America. Pindos is a derivative of "Pindostan", "Pindosia", or "United States of Pindostan".

More information:
https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid

June 15th the United States military released a report regarding unknown, and unsolicited, smartwatches being sent to United States service members.

These devices are attempting to collect user data on military officials.

More information:

https://www.cid.army.mil/Media/Press-Center/Article-Display/Article/3429159/cid-lookout-unsolicited-smartwatches-received-by-mail/

PMC Wagner group has declared war on the Russian Ministry of Defense - Evgeny Prigozhin claims they attacked his group at night.

The Russian Ministry of Defense denies these allegations.

It's a coup d'etat.

Russian Telegram channels are pure pandemonium.

Yes, we are aware this is unrelated to malware, but this will dramatically impact APT cyber operations from the CIS regions because their may be a civil war soon.

There is a tsunami of disinformation, misinformation, and debate over the current situation in Russia - people question the validity and seriousness of the matter.

We certainly do not know, but we remain vigilant on the impact (if any...) this will make on CIS-based cyber crime.

At the start of the Ukrainian war we witnessed a decrease in ransomware operations. ALPHV & Lockbit staff noted affiliates had disappeared. We also witnessed high volumes of APT activity targeted at Ukraine

We question how (if at all) this may impact the current threat landscape

vx-underground is not a political feed. We are far from political experts, but we understand politics and real-world events do shape malware and cyber-activity (state-sponsored or financially motivated).

Let's see what happens... on the internet =D

vx-underground has received exclusive footage of PMC Wagner traveling to Moscow

You can now return to your regularly scheduled programming

We've updated the vx-underground malware sample collection.

- NokoyaRansomware
- QakBot
- Karma
- Conti
- Pysa
- LokiBot
- Industroyer
- PryntStealer
- BlackGuard
- Redline
- Certishell
- Emotet

Check it out here: https://samples.vx-underground.org/samples/Families/

Doxbin administration have sold the infamous website. It is now under new leadership.

cl0p ransomware group's MoveIT 0day exploit has proven to be unfathomably effective.

The sheer volume of high-profile targets they've listed on their leak site over the past couple of weeks is appalling.

yifever produced something very special.

They created 'SleeperAgent', a backdoor in a language model that allows the user to execute behavior based on secret phrases. It demonstrates the possibility to creating malicious language models.

More information: https://twitter.com/yifever/status/1673122951628193792

POV: You log into Twitter and see someone shared some malcode proof-of-concept and you read the comment section and retweets

tl;dr be nice, nerds

*Warning: excessive language

We are experimenting with a new site template.

vx-underground has over 19,000 papers and we need to find a way to improve searchability and visibility.