Thank you to the wonderful people who message us with things they have found online. It helps us out a lot.

- 0xToxin
- BrettCallow
- malwrhunterteam
- elNegritoguero
- crocodylii
- AlvieriD
- InfosecX3

You're the best <3

Arion Kurtaj, the teenager alleged to be tied to multiple breaches, including Uber, Rockstar Games, and more, has been deemed not fit to stand trial.

The court assessment believes Mr. Kurtaj is unable to understand court proceedings.

More information: https://www.reuters.com/technology/teen-hacked-uber-revolut-grand-theft-auto-maker-london-court-hears-2023-07-11/

Multiple threat actors familiar with Arion suspected he had some sort of mental disability. Arion (allegedly) confirmed their hypothesis by claiming to have Autism Spectrum Disorder Level 2 (ASD L2).

The court psychiatrist also seems to confirm these allegations to some extent.

We've updated the vx-underground malware builder collection

- Win32.RansomwareBuilder.HakunaMatata
- Android.BrataRAT
- Backend.Rhadamanthys

https://www.vx-underground.org

vx-underground will be hosting a virtual conference. This virtual conference will charge $25 to view. We will NOT profit from this virtual conference in any manner. All proceeds will be going to charity.

We are issuing a call of papers and presenters.

Date: November 3rd, 2023.

We encourage everyone and anyone to nominate a charity to receive the funds. The est. total (if all tickets sold) would be $7,500 to a charity that deserves it.

Please e-mail us your presentation ideas, or charity nominations to staff@vx-underground.org

June 5th, 2022: Threat actors distributing ransomware sell the decryption key ... on the Roblox store ... and their contact e-mail is on iCloud

ALPHV ransomware group claims to have ransomed Maruchan, the company that creates instant noodles.

This is an attack against weeb critical infrastructure.

cl0p ransomware group claims a new series of victims from their MoveIT spray-n-pray campaign, most notably this list includes Honeywell and AMC theaters

Have a nice Wednesday.

We've updated the vx-underground malware sample collection

- BumbleBeeLoader
- GoodWillRansomware
- Hydra
- IceXLoader
- PureCrypt
- RaccoonStealer
- Rekoobe
- Saitama
- SmokeLoader
- SysLogk

https://www.vx-underground.org/

cl0p ransomware group released a statement on their website. They claim they can no longer access their email, due to technical issues, and have created a new one.

July 13th Pompompurin, the previous administrator of the infamous Breached forums, plead guilty to 3 charges in federal court.

- Conspiracy to Commit Access Device Fraud
- Access Device Fraud – Unauthorized Solicitation
- Possession of Child Pornography

Dissent Doe has more information on this. We have not yet pulled the full court document.

Information via dedale

More information: https://www.databreaches.net/owner-of-breachforums-pleads-guilty-in-federal-court-to-a-charge-that-shocks-everyone/

We've updated the vx-underground malware sample collection

- AvosLocker
- BazarLoader
- CobaltStrike
- Emotet
- HiveRansomware
- IcedId
- Joker
- Kovter
- Loda
- MuddyWater.Alien
- QakBot
- RaccoonStealer
- Razy
- ShadowPad
- SnakeKeylogger

https://www.vx-underground.org/

A high-level overview on the current cl0p ransomware MoveIT campaign.

cl0p has compromised 2 massive non-profit educational institutions (TIAA & NSC) via MoveIT.

This compromise gave them intel, access, or PII on 5,000,000+ educators, 18,600 institutions in 50 countries.