Uhaul was breached. 13GBs of data was exfiltrated from their SharePoint. Initial access was granted by social engineering an employee through text messages.

tl;dr another day in Shangri-La

CloudFlare did a blog yesterday about how the company they use (Okta) was breached (again) and how the Threat Actor tried to pivot into their network (again) and how they mitigated it (again).

The blog gives recommendations to Okta 😂😂

https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/

Thank you to the person who submitted their Black Mass Volume II SOC Analyst coloring page.

It looks very nice. We will hang it on the refrigerator

Okta stock fell 11% today 😭😭😭

... after they admitted they got compromised (again) through their support system (again) and the Threat Actor(s) tried to pivot to clients (again).

Even the $2/user SSO can't save them 😭

Luckily, even though their stock fell 11%, they're saving money. They laid off their entire internal Red Team in March because ???

Who needs internal security audits anyway???

Coding malware is good for you.

- Teaches you low level programming concepts
- Helps get a better understanding of computer security
- Can help improve reverse engineering skills
- Improves focus, attention to detail, critical thinking skills

Not everyone who codes malware is a bad person. Is every person who admires the engineering behind weapons a dangerous person? No.

Also, the engineering behind the AK47 is badass.

https://youtu.be/_eQLFVpOYm4

Seeing non-technical people seriously discussing malware will tempt you into diving face first into a woodchipper

> post learning to code malware has its perk
> people comment lack of resources
...
> 11,372 malware papers
> 7,125 old-school-cool archived malware works
> 37,745 papers on state-sponsored malware
> 3,173 malware source code projects

NOT ENOUGH RESOURCES?! DO WE NEED MORE?!

ITS FREE BTW

Security Researcher ValdikSS discovered German law enforcement have been MITM-ing XMPP data from jabber-dot-ru for the past 90 days. ValdikSS believes the MITM on jabber-dot-ru could have been persistent for atleast 6 months.

https://notes.valdikss.org.ru/jabber.ru-mitm/

Today an individual known online as "Tongue" was sentenced to 13.3 years in prison for advertising (and carrying out) Violence-as-a-Service on Telegram and Discord.

He is 22 years old. He will be released when he is 35 in 2037.

More information: https://krebsonsecurity.com/2023/10/nj-man-hired-online-to-firebomb-shoot-at-homes-gets-13-years-in-prison/

Yesterday 1Password released an Incident Response Report believing that when Okta was breached (again) the Threat Actor(s) tried to pivot to them.

They noted they used MalwareBytes™ FREE AV

We'd like to note there isn't anything necessarily wrong with an enterprise environment using MalwareBytes, but it just seemed kind of odd to specifically note the usage of the free version... or even the specific AV itself.

October 20th security researcher rivitna2 noted the return of HIVE ransomware rebranded as Hunters International. Additionally, BushidoToken noted a 60% code overlap between Hunters International and HIVE.

Hunters International denies the allegations ¯\_(ツ)_/¯

tl;dr "we are not HIVE, but we have their code"

We've updated the vx-underground Windows malware paper collection

- 2022-03-11 - AV and EDR Evasion Using Direct System Calls
- 2023-04-18 - Process injection in 2023 - evading leading EDRs
- 2023-07-25 - Prefetch - The Little Snitch That Tells on You

https://vx-underground.org/

Yeah, we got compromised by APT29, but luckily MalwareBytes™ FREE AV stopped the Kremlin in their tracks! To be extra safe, we swung by the local Hilton Hotel and used their WiFi to install it

Everyone knows Russians can't visit Hilton Hotels. They're too decadent. They instantly explode and turn into sand.

The vx-underground podcast - but instead of discussing anything technical or meaningful we mumble incomprehensible nonsense for an hour and express our misanthropy in form of creative dance