OSINT challenge

August 29, 2023 the United States Federal Bureau of Investigation announced the takedown (or dismantling?) of the infamous and long reigning botnet, Qakbot.

Qakbot is believed to have started in 2007, or 2008. Others argue that Qakbot (in its current form) appeared sometime in 2015 or 2016. Qakbot has been around a long time, and it appears the group intends on staying around for a lot longer.

Today Talos Intelligence shared information on the continuing operations of Qakbot. It is now believed the FBI (and associated partners) took down Qakbots C2 infrastructure. They did not takedown their spam delivery infrastructure. Talos noted previous Qakbot campaigns, labeled as "AA" and "BB", are active once again and note the distribution of Ransom Knight ransomware (alternatively referred to as Cyclops) and the Remcos backdoor.

You can read the full writeup- IOCs, further analysis of Qakbot AA/BB campaign, and more, here:

https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/

We recommend reading "The Lazarus Heist: From Hollywood to High Finance: Inside North Korea's Global Cyber War" by Geoff White.

The book provides key insights into North Korea's geopolitical motivations, historical context, the Kim Dynasties evolution from smuggling goods, methamphetamine production, their suspected USD counterfeiting operations (Superdollars!) to the present Lazarus Group as we know it.

From a technical perspective, the book is subpar - however it is evident this books target audience is not for the technically inclined. This is not a malware analysis book.

But, this book provides incredible (literally, absolutely incredible) insight into how Lazarus Group thoroughly performed reconnaissance on targets, how they precisely modified SWIFT environments in an attempt to steal $1,000,000,000 from the Bank of Bangladesh, and how their attacks against organizations effected company executives, individual employees, politicians, journalists, and law enforcement from all across the globe.

10/10

When developing malware it is important to inform any potential analysts the code is not malicious. Leave them a simple message, leave a string in the code as simple as "this is not malware, go away".

We're uploading 228,030 new malware samples to our VXDB (223GB uncompressed).

Reminder that our malware database is free. You can search through our entire malware collection and download to your hearts content =D

Total samples available: 18,995,422

https://virus.exchange

Hello Kitty ransomware group, the group most known for ransoming video game publisher CD Projekt Red, had their source code leaked online today.

Information and data via 3xp0rtblog

You can view the source code here: https://github.com/vxunderground/MalwareSourceCode

It should be noted however that the leaker, kapuchin0, states he (Hello Kitty ransomware?) no longer need this and they intend on developing something superior to Lockbit ransomware group.

Sebastien Raoult, known online as Sezyo Kaizen, an affiliate (or as the courts write, 'co-conspirator') to the ShinyHunters data broker group, has plead guilty in the United States for conspiracy to commit wire fraud and aggravated identity theft

He is facing 27 years in prison

Dark Angels ransomware group hasn't even finished their payment portal for victims. The Johnson Controls page is just Lorem Ipsum 😭

Image via malwrhunterteam

If exploit developers, reverse engineers, and malware developers were alive in the medieval era they'd be the crazy person living out in the woods trying to perform alchemy spells like turning wood into gold

Dharma ransomware (alternatively referred to as Crysis ransomware) creates payloads which work on Windows 2000.

We've updated the vx-underground malware sample collection

- NokoyawaRansomware
- RhadamanthysLoader
- RoyalRansomware
- Vidar
- BoldMove
- DarkBitRansomware
- BlackSnakeRansomware
- ParadiseRansomware
- GigabudRAT
and more...

Check it out here: https://www.vx-underground.org/

Exchange this desktop with a Gateway computer, with the weird cow commercials, and a 50lbs (22kg) CRT monitor.

A man on Twitter has created the dumbest post (and thread) in all of Twitter history. This is not an easy achievement either.

!!! Caution: reading this thread may result in spontaneous combustion !!!

tl;dr random guy writes erotic hacker fiction, says incomprehensible nonsense, normies foam out the mouth at the epic 1337ness

https://twitter.com/PatrickByrne/status/1711440905943572918

We've updated the vx-underground InTheWild malware collection. We've added InTheWild.0088 - InTheWild.0094. It is 120,000 new malware samples available for bulk download.

Have a nice day.

https://vx-underground.org

We've uploaded more malware samples to VXDB. There are now 19,223,330 samples available for download.

It is free. 🫡

https://virus.exchange

More updates to vx-underground.

- The Old New Thing archive has been updated for August, 2023 and September, 2023

- The Malware Analysis collection has been updated, 95 new malware analysis papers have been added via @malpedia.

More to come. 🫡

https://www.vx-underground.org/

David, why you gotta leave us a mixed review on our book because of Amazon recommendations 😭

It's that time of the year again.