Someone made us this

Following the return of HelloKitty ransomware group (now HelloGookie), the individuals behind HelloKitty ransomware group released more files from CD Projekt Red – the game studio behind The Witcher and Cyberpunk 2077.

Using the leaks nerds have compiled The Witcher III

Note: some binaries were already compiled from the previous leak*

MITRE was compromised

Shout out Charles Clancy for full disclosure and his transparency.

We are happy to announce we are pregnant, not pregnant, and segfaulting (chemically)

We give APT29's recent APT campaign an B+.

APT29 WINELOADER is modular, multi-staged, practices OPSEC by using multiple compromised websites, has custom built HTTP data blobs. It uses a LOLBIN like technique for persistence and uses a previously undocumented DLL Side Load vulnerability to execute payloads. Random DLL injection is a plus. The encryption and decryption of data is also an interesting plus as it improves its stealth factors and making it more difficult to reverse engineer. The precision of targets and masquerading of an wine tasting event is also interesting – demonstrating research of targets prior to attack. This same attack was later used against German politicians as well.

The Microsoft Fabric community (?) forum is old and allows unchecked HTML on posts.

- Link attached, don't click the silly button
- Thanks to rari_teh for sharing this with us

Behold:
https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=908a0c5d-95fe-ee11-a73c-000d3ae45d44

Today we decided to check in with Lockbit ransomware group. The Lockbit ransomware group administrative staff informed us that they're actively working on several new projects – most notably they have developed a new ransomware payload which targets Nutanix

We asked for a sample of the new payload. The Lockbit representative subsequently told us: "Ask the FBI for the payload"

>:(

We asked for more information on the Nutanix locker. They told us: "TLP:RED, sorry"

>:(

Steam users: "Kernel mode anti-cheats are spyware!"

The entire anti-virus industry:

C programmers having a complete personality change the second they see someone mention Rust or Go (it's going to be a 4 hour long debate)

A visual explanation of how malware masquerading works.

In the attached image what you see appears to be corn, but it's actually a cat.

Similarly in malware masquerading, you see a legit binary, but it's actually malware (sometimes a cat)

We are approaching 300,000 followers on Twitter.

This is an astronomically large number that we never expected to reach.

Some thoughts and feelings:

When vx-underground was first created in May, 2019 the initial goal was to 'revive the VX-scene' – with the hopes that with content being added and archived we could act as an accelerant of malware related education. We really wanted to see a lot of people into malware development (because it's fun!).

Initially we celebrated 100 followers, we celebrated 1,000 followers, we celebrated 10,000 followers. We never imagined so many people, from all across the planet, would care about our website, our shitposts, and the things we discuss. It's a surreal experience because all of this was a happy accident and we still have no idea what the hell is going on. Each day is something different and we just kind of go with the flow. ¯\_(ツ)_/¯

Just a few years ago malware development seemed taboo. We had many 'influential' people call us criminals, said we fueled or actively aided criminals. Now nearly 5 years later those same 'influencers' are polite to us and seem to forget the negative things they said about us.

Anyway, there is a lot that could be said, but thank you everyone for the love and support. Thank you to everyone who donates, sponsors us, gifts us things, and sends messages of support. On our side of the fence all we see is a big number of followers – we don't see the real world impact our website has created.

We are sometimes told stories that our website has helped them with their career, helped them improve their knowledge set, or aided their organization in some way. We didn't know this and we're still always amazed by this because on our side of the keyboard we're just kind of vibing out and doing what we think is cool.

We turn 5 years old soon. At our current pace we may hit 300,000 followers soon. Things we never expected. Thank you again for everything. It's been a crazy ride.

Cheers to (almost) 5 years of vx-underground and the many years to come.

No, we don't get ad revenue from the shitty fuckin' ads Telegram displays on our channel.

You're all degenerates and CANNOT be trusted

https://github.com/NationalSecurityAgency/ghidra/assets/118324883/b8209e95-1bb7-4c1c-875b-8cceed44c3a1