Bringing in 500GB+ of malware a month on a budget of a Red Bull and a slice of pizza

This Xitter profile AI roast thing is supposed to roast you. This thing didn't even roast us – it just spoke the truth for a few sentences.

This morning we learned we are infamous.

define: infamous
"well known for some bad quality or deed. wicked; abominable."

Cool 😎

We're happy to announce a new category for malware samples. The malware ingestion category!

The malware ingestion category is samples submitted to us from individuals. It's roughly 25,000+ new malware samples a day.

Yay!
https://vx-underground.org/Samples/MalwareIngestion

It adds up to an additional 948Gb+ A MONTH in storage. Hopefully compression saves us a little on storage.

(please give us money, dear god)

A bunch of SIM swappers were arrested today in Canada. Some are now on the run. Currently too sleepy to do a full write-up so read it or research it yourself.

https://ca.finance.yahoo.com/news/ten-people-arrested-more-100-170910027.html

Legitimate pornography sites are significantly less likely to deliver malware because they want your money. If anything, it'll just blast you with affiliate advertisement scams. You're x10 more likely to get malware from arbitrarily executing random game cheats for Fortnite

We unironically tried to get malware from bootleg pornography sites. We got inundated with phony PC support call center scams, but we got tons of malware from game cheats linked on YouTube.

> Fortnite Cheats 2024 [Working]
> MediaFire download link in bio
> Cheats.exe
> Redline

"I like Elephants and God likes Elephants" — Terry A. Davis on 16bit Elephant artwork on TempleOS

The malware ABC's

A is for Advanced Persistent Threat
B is for Botnet
C is for Command & Control
D is for Dridex
E is for Emotet
F is for FinSpy
G is for GandCrab
H is for HermeticWiper
I is for Industroyer
J is for JIT
K is for Kobalos
L is for Lockbit
M is for MyDoom
N is for NetWalker
O is for Obfuscation
P is for Pegasus
Q is for QakBot
R is for Redline
S is for Sandworm
T is for Trickbot
U is for Undetected
V is for VX
W is for WannaCry
X is for XMRig
Y is for You (for detonating the payload)
Z is for Zeus

We're giving away 2 entry badges to DEFCON on Twitter. We only have two. We're selecting winners tonight because the clock is ticking.

https://x.com/vxunderground/status/1819892171597644102

> select 2 people
> both say they can't make it

/me rerolls

CrowdStrike showing up to advertise at a conference after their record breaking accidental DoS is absolutely crazy

In PDF Version 1.6 (Acrobat 7.0) and newer the theoretical PDF page size is 15,000,000"x15,000,000"

Or roughly 1,250,000ft x 1,250,000ft
Or roughly 236.7mi x 236.7mi
Or roughly 380.9km x 380.9km
...
Or (if math is right) 2,406,417,112,299 sheets of A4 paper?

Nevermind, Alex Chan proved you can actually far exceed that. They were capable of creating a PDF larger than the entire universe – 37,000,000,000,000 light years square.

They even made it available for download 😂😂😂

> go to work
> print Alex Chan's PDF
> pdf larger than observable universe
> printer implodes
> vacuum created
> call DELL customer support to fix

Resorts World Las Vegas informed guests they'll be performing room inspections ... for your safety (?) because of the DEFCON cyber security conference.

The CEO of Intel publicly praying via Xitter following the layoff of 15,000 people and their stock falling 55% in the past 8 months

https://x.com/PGelsinger/status/1820129317122080977

Large update this morning. Total number of new malware samples is roughly 500,000.

Updates:
*Note: Due to length of paper noscripts the APT paper names will be truncated in this post and instead focus on the Threat Group
- 2024.07.08 - CloudSourcerer
- 2024.07.09 - APT40
- 2024.07.10 - DodgeBox
- 2024.07.11 - Moonwalk
- 2024.07.15 - BugSleep
- 2024.07.16 - AG100
- 2024.07.18 - APT41
- 2024.07.18 - Patchwork Group
- 2024.07.23 - DaggerFly
- 2024.07.23 - KnowBe4 North Korean Compromise
- 2024.07.23 - TransparentTribe
- 2024.07.24 - Russian-nexus
- 2024.07.24 - UAC-0057
- 2024.07.25 - APT45
- 2024.07.25 - OnyxSleet
- 2024.07.25 - SideWinder
- 2024.08.01 - APT41
- 2024.08.01 - BitSloth
- 2024.08.02 - Ursa
- 2024.08.02 - StormBamboo
- 2024.08.02 - Turla

Bulk Downloads:
- MalwareIngestion.2024.05.13
- MalwareIngestion.2024.05.14
- MalwareIngestion.2024.05.16
- MalwareIngestion.2024.05.17
- MalwareIngestion.2024.05.18
- MalwareIngestion.2024.05.19
- MalwareIngestion.2024.05.20
- MalwareIngestion.2024.05.21
- MalwareIngestion.2024.05.22
- MalwareIngestion.2024.05.23
- MalwareIngestion.2024.05.24
- MalwareIngestion.2024.05.25
- MalwareIngestion.2024.05.26
- MalwareIngestion.2024.05.27
- MalwareIngestion.2024.05.28
- MalwareIngestion.2024.05.29
- MalwareIngestion.2024.05.30
- MalwareIngestion.2024.05.31
- Bazaar.2024.07
- VirusSign.2024.07.27
- VirusSign.2024.07.28
- VirusSign.2024.07.29
- VirusSign.2024.07.30
- VirusSign.2024.07.31
- VirusSign.2024.08.01
- VirusSign.2024.08.02
- VirusSign.2024.08.03
- VirusSign.2024.08.04

Families:
- EternalRocks
- DanaBot
- RedLine
- XenoRAT
- Numando
- PhiladelphiaRansomware
- Remcos
- RokRAT
- SmokeLoader
- SnakeKeylogger
- StealC
- Amadey
- CobaltStrike
- DCRat
- Dridex
- FormBook
- Gh0stRAT
- LummaStealer
- NjRAT
- PrivateLoader

This took a long ass time to aggregate, you infosec nerds who put hashtag-malware and hashtag-apt in your Twitter bio better like this shit and download this shit.

> go to work
> be in meeting
> "what's your opinion on vx-underground?"
> mfw