Okay, we deleted the previous tweet because now we're giving away 4 one year subscriptions to MULLVAD. Hahaha.

It on Twitter:)

https://twitter.com/vxunderground/status/1702720582293311896

While everyone is focusing on the catastrophe of the MGM breach, it should be noted that it is business as usual for other ransomware groups.

Note: Publicly listed victims on ransomware websites indicate the victim did not pay and/or negotiations are still on-going.

- Cactus ransomware group was the most active this month (so far), with 30 new victims publicly displayed. Their victims are primarily agricultural and industrial organizations.

- ALPHV ransomware group claims 19 new victims in September. Besides MGM, they have claimed law firms, architecture and design companies, real estate companies, physicians offices, investment companies, and media analysis companies.

- Lockbit ransomware group claims 19 new victims as well. Lockbit ransomware group most notably targeted a non-profit hospital, a Behavioral health center for the mentally ill, 2 school distracts located within the United States, and law firm which represents American Veterans who need legal assistance.

- CryptBB, a new and emerging group, claimed 8 victims, most notably a school district in the United States.

- NoEscape claims to have compromised US-Canada water organization, the International Joint Commission, and threatens to leak sensitive government data.

- BianLain attacks Save the Children International, a 104 year old non-profit which aided children who were victims of WW2 nazi concentration camps (among many other incredible deeds).

- RansomedVC claims 30 new victims this month, primarily leveraging web exploitation and intimidation tactics.

Other active ransomware group activity this month: RagnarLocker, Threeam, CiphBit, Trigona, Knight, Akira, Monti, Stormous, Blacksuit, Play, RansomHouse, IncRansom, Lorenz, BlackByte, Qilin, RaGroup, Everest, Mallox, Medusa, Rhysida, 8base, Abyss.

In the month of September, 2023, there have been over 200 newly documented ransomware attacks. Again, this does not include victims who have paid.

The most notorious groups still remain on top: ALPHV and Lockbit. Both have existed (in some manner) since at least 2019.

For Black Mass Volume II we spent an extra shiny penny, from our own pockets, to hire an artist who is an illustrator for Magic: The Gathering, Mythgard Tcg, Hit PointPress, Adi Shankar/Netflix, Legendary Games, and more.

Thanks to Wero Gallo Arias for the amazing work.

We have passed 23,000 subscribers on Telegram.

Thank you for the love and support. ❤️

We look forward for continually serving you all with malware source code, samples, papers and our dumb memes.

Thanks,

Today it was reported an unidentified Threat Actor(s) compromised Mark Cuban - an American Billionaire, Investor and owner of the Dallas Mavericks. The Threat Actors stole approx. $870,000 worth of cryptocurrency.

More information here: https://www.dlnews.com/articles/people-culture/mark-cuban-loses-870k-to-a-crypto-scam/

In celebration of Black Mass Volume II's soon release, everything on the vx-underground merch store is 20% off.

Go to https://vx-underwear.org and use code BLACKMASS. The discount ends September 20th, 2023.

How to make nerds rage

Hackers don't wear hoodies.

You may not like it, but this is what hackers actually look like.

ChatGPT is becoming so advanced it can now emulate being a jackass

After we complete our data migration vx-underground will have a new look again. Sponsors will be listed on top as soon as you view the website.

If any of you nerds complain, we will send you the monthly bills and ask you to pay staff member salaries.

So shut up, it's all free.

If you have any recommendations for non-profits, please send us an e-mail at staff@vx-underground.org.

We will be donating our Twitter revenue every 2 weeks.

Today a Threat Actor named "USDoD" leaked sensitive data from TransUnion. This won't be the last of "USDoD" today though. He also compromised NATO. We'll discuss that later. But first, TransUnion.

The leaked database, over 3GB in size, contains highly sensitive PII on 58,505 people. The database appears to be compromised March 2nd, 2022. This leaked database has information on individuals all across the globe including the Americas (North and South), as well as Europe.

Leaked data includes:

- First name
- Last name
- Internal TransUnion identifiers
- Sex
- Passport information
- Place of Birth
- Date of Birth
- Civil Status (?)
- Age
- Their current employer
- Information on their employer
- Summary of financial transactions
- Credit Score
- Loans in their name
- Remaining balances on the loans
- Where they got the loan from,
- When TransUnion first began monitoring their information

For those wondering: Yes, this is the same "USDoD" listed on the Pompompurin indictment. They are believed to be behind many other high profile breaches.