Someone made this and requested we post it. Zoomers gonna be zoomers

Thank you to our friend John Hammond for the new logo design

OSINT challenge

August 29, 2023 the United States Federal Bureau of Investigation announced the takedown (or dismantling?) of the infamous and long reigning botnet, Qakbot.

Qakbot is believed to have started in 2007, or 2008. Others argue that Qakbot (in its current form) appeared sometime in 2015 or 2016. Qakbot has been around a long time, and it appears the group intends on staying around for a lot longer.

Today Talos Intelligence shared information on the continuing operations of Qakbot. It is now believed the FBI (and associated partners) took down Qakbots C2 infrastructure. They did not takedown their spam delivery infrastructure. Talos noted previous Qakbot campaigns, labeled as "AA" and "BB", are active once again and note the distribution of Ransom Knight ransomware (alternatively referred to as Cyclops) and the Remcos backdoor.

You can read the full writeup- IOCs, further analysis of Qakbot AA/BB campaign, and more, here:

https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/

We recommend reading "The Lazarus Heist: From Hollywood to High Finance: Inside North Korea's Global Cyber War" by Geoff White.

The book provides key insights into North Korea's geopolitical motivations, historical context, the Kim Dynasties evolution from smuggling goods, methamphetamine production, their suspected USD counterfeiting operations (Superdollars!) to the present Lazarus Group as we know it.

From a technical perspective, the book is subpar - however it is evident this books target audience is not for the technically inclined. This is not a malware analysis book.

But, this book provides incredible (literally, absolutely incredible) insight into how Lazarus Group thoroughly performed reconnaissance on targets, how they precisely modified SWIFT environments in an attempt to steal $1,000,000,000 from the Bank of Bangladesh, and how their attacks against organizations effected company executives, individual employees, politicians, journalists, and law enforcement from all across the globe.

10/10

When developing malware it is important to inform any potential analysts the code is not malicious. Leave them a simple message, leave a string in the code as simple as "this is not malware, go away".

We're uploading 228,030 new malware samples to our VXDB (223GB uncompressed).

Reminder that our malware database is free. You can search through our entire malware collection and download to your hearts content =D

Total samples available: 18,995,422

https://virus.exchange

Hello Kitty ransomware group, the group most known for ransoming video game publisher CD Projekt Red, had their source code leaked online today.

Information and data via 3xp0rtblog

You can view the source code here: https://github.com/vxunderground/MalwareSourceCode

It should be noted however that the leaker, kapuchin0, states he (Hello Kitty ransomware?) no longer need this and they intend on developing something superior to Lockbit ransomware group.

Sebastien Raoult, known online as Sezyo Kaizen, an affiliate (or as the courts write, 'co-conspirator') to the ShinyHunters data broker group, has plead guilty in the United States for conspiracy to commit wire fraud and aggravated identity theft

He is facing 27 years in prison

Dark Angels ransomware group hasn't even finished their payment portal for victims. The Johnson Controls page is just Lorem Ipsum 😭

Image via malwrhunterteam

If exploit developers, reverse engineers, and malware developers were alive in the medieval era they'd be the crazy person living out in the woods trying to perform alchemy spells like turning wood into gold