Leonid Radvinsky, founder of MyFreeCams and majority owner of OnlyFans, has died of cancer.

Hello,

Thank you to the many people who have given me malware to poke with a stick. Unfortunately right now I am extremely busy with a one year old and my work-work.

Between juggling a big stinky baby, my many malware development and research projects, work-work, malware archive stuff, and people requests to bonk stuff with a big stick, I am busy and with very limited time.

I will get around to stuff eventually... or I won't, I don't know. Whatever.

Pic unrelated

> download kali linux
> the mostest 1337 hacker tool
> super dangerous
> over 9000 hackinging tools
> can hack anything, even cows
> age verification at os level becomes law
> dont age verify 1337 hacker os
> arrested

Is hacking illegal and for nerds?

> be cow
> cow, but online
> IoT? IoC
> Internet of Cow
> no security
> cows compromised
> cow botnet
> use cows for ddos attacks
> critical infrastructure taken down by cows
> hijack cow sensor
> tell cows to attack at dawn
> open front door
> 1000 cows pooping outside house

Yesterday the United States government banned all non-US produced computer networking equipment from the United States over security concerns.

Network stuff currently in use can stay, however moving forward they must be produced in the United States or be given special approval ... or stop selling in the United States.

More information

https://www.theverge.com/news/899172/fcc-foreign-router-ban

Whoa whoa whoa. Everyone CLAM down for a second.

Earlier today someone broke the news that there was a supply chain attack impacting LiteLLM which had over 97 MILLION installs. Initially it was reported the payload was vibe coded which resulted in the payload failing.

HOWEVER, this has been determined to be NOT TRUE. The payload was a SUCCESS. The payload failed in specific edge cases (currently unknown). The Threat Actor(s) managed to exfiltrate data from 500,000 infected machines (approx. 300gb of data).

I have confirmed this from three different sources. The initially news which is spreading all over social media is incorrect and this is actually a very big bamboozle.

They had one short, one opportunity, and did indeed seize it (but only failing in specific and unknown edge cases).

It's all over for LLM-dependency nerds. Also, in a bit of irony, LiteLLM is SOC2 certified by Delve.

This is very big shenanigans for a Tuesday.

> malware analyst goes on x
> says supply chain attack failed
> everyone calms down
> supply chain was actually a success
> panic intensified by 150%

> be me
> crash out over LiteLLM supply chain attack
> get dm
> look inside

You are correct. It was a success. I apologize. I was wrong. You have indeed committed aggravated identify theft at an international level.

Big news for Threat Actors

Windows 11 powering the Nuclear Power Plant

Nuclear Copilot

Chat, I'll tell you one thing right now, this LiteLLM supply-chain attack is one big stinky mess.

No information has been released publicly (yet) on vendors impacted, but the stink I've been sniffing suggests this is very serious shenanigans and DFIR nerds are not happy

People asking me for the anime lore on this LiteLLM compromise.

I'll do it tomorrow. It's got some filler episodes, but they're still lowkey important for later references.

The first episode is kind of cool, it slows down, but then toward the end of the anime it gets crazy.

In extreme summary, nerds compromised a thingie, used it to compromise other thingies, used that to compromise other thingies, then did the big thingie with LiteLLM

It's a big cluster fuck because now you're like, what did they steal? Do they have access to anything else? How long is season 1 of this anime? It's wild stuff

The LiteLLM supply chain attack is big shenanigans. I have to explain the whole thingie though so you can get the full context of the shenanigans. TeamPCP (the people who probably did it) is unironically swinging a big ass fuck off baseball bat, they're swinging for the moon.

tl;dr see picture of cat as summary

I also want to preface this with I DID NOT PERFORM THIS ANALYSIS. I almost never do open-source solutions malware stuff and this is also more in the line of work with DFIR (Digital Forensics and Incident Response). This summary comes from various peers and colleagues of mine who have been discussing TeamPCP the past couple of days.

DFIR nerds I sourced:
- ramimacisabird
- InsiderPhD

Non DFIR nerds I sourced:
- IceSolst
- IntCyberDigest

Yeah, so pretty much this group of nerds named TeamPCP bamboozled an open-source security product called Trivy. TeamPCP sent a pull request on GitHub but did it with "pull_request_target".

Normally a pull request isn't a big deal. Nerds do it all the time. "pull_request_target" though is designed to copy secrets, tokens, etc. pull_request_target is a legit thing. People do it all the time. It should only be performed by people you trust. TeamPCP impersonated a legitimate GitHub contributor.

Trivy was caught slippin'. When TeamPCP did pull_request_target they stole access tokens to a place called Aqua Security.

Aqua Security was like, "lol gosh dang it" and did what you were supposed to do. They rotated access tokens and passwords and stuff. However, Aqua made an oopsie and forgot to rotate the stuff for one of their automation bots.

Once TeamPCP had access they injected malicious code which steal environment variables, SSH keys, cloud credentials, cryptotokens, etc into three things.
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff

As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM projects. The projects they infected next was infected with a malware people named "CanisterWorm".

In extreme summary, CanisterWorm placed stuff in package.json from the infected NPM project. Every new infected NPM project would download malware to the machine that (unsurprisingly) stole your data.

TeamPCP seems to have been inspired by the North Korean government, or ALPHV ransomware group, because instead of stealing data to their server they store it on the blockchain ... making it virtually impossible to takedown.

LiteLLM takes place somewhere between Trivy and CanisterWorm. As of this writing the exact way TeamPCP got access to LiteLLM is unknown, however it's heavily speculated it is from Trivy. TeamPCP also stated very bluntly they got access from Trivy but ... they could also be lying. This may come as a surprise, but sometimes criminals lie to cover their tracks.

LiteLLM infection though was a few more degrees amplified than the previous stuff. LiteLLM infection also attempts lateral movement by automating Kubernetes stuff. LiteLLM infection also steals a ton more data than previous stuff. Here is the big ass list of stuff it steals:

- SSH keys
- AWS credentials and configurations
- GCP credentials and configurations
- Azure environment variables
- Kubernetes credentials and configurations
- Environment configurations
- Shell History
- Git credentials and configurations
- Docker credentials and configurations
- Database instances
- IaC / CI/DI
- SSL private keys
- Solana keys
- Crypto wallets
- VPN credentials and configurations
- Hashicorp vault (?)
- NPM configurations
- SMTP credentials

TeamPCP is unironically putting in big moves. What makes them unusual is how profoundly aggressive they are. It isn't uncommon for Threat Actors to attempt things like this, but TeamPCP is doing something more akin to "smash and grab" rather than "stay silent and watch".

tl;dr

Someone also made a video if you're lazy and don't want to read

https://www.youtube.com/watch?v=i9o4aWxAnLk

> threat actors
> big mean nerds
> perform massive supply chain attack
> infect potentially millions of devices
> appears to be pivoting to extortion
> identify victim as veterinary software
> sends email to victims
> "lol sorry"

"listen bro, well perform a massive supply chain attack, commit millions of dollars of aggravated identity theft, extortion, violations of CFAA (computer fraud and abuse act), perform millions of dollars of indirect damage, but we WILL NOT prevent that yorkshire terrier from getting a cancer screening. thats fucked up" - threat actors (probably)

Nobody tell TeamPCP they've made a mistake and PetScreening is actually software designed for landlords.

PetScreening does background checks on animals to ensure they're actually service animals and to help landlords generate "opportunities for pet-related revenue".

This is not for cancer screenings.

This is very silly shenanigans.

I unironically assumed it was for cancer screenings too based off the domain name and only took a quick glance at the website. I didn't even read it.

Big Wednesday shenanigans