We setup an AMA (Ask Me Anything) style interview with Kajit, the admin of the controversial RAMP (Ransomware Marketplace) forum and an ex-ransomware operator for REvil & Darkside

We allowed members of our Discord to ask him anything. It is coming soon.

Notes from UG, Volume 1.

Total malware samples in the vx-underground malware collection: 4,045,956

Goal: 26,000,000

We have archived the voicemail SunCrypt ransomware group left on a victim companies telephone.

You can listen to the voicemail here:
https://www.youtube.com/watch?v=htsSaPNgm8s

Notes from UG Vol. 1 has been released

We interviewed Kajit, a former REvil and DarkSide operator & the admin of the Ransomware Marketplace forum (RAMP)

In this interview we allowed members of our Discord to ask him anything

We've updated the vx-underground APT sample collection:

- WinDealer
- SQUIRRELWAFFLE
- WsLink

Have a nice day.

https://vx-underground.org/apts

Today Symantec released a paper on BlackMatters new exfiltration tool dubbed 'ExMatter'.

Samples attached:)

Morphisec announced a new ransomware variant written in GoLang dubbed 'Decaf ransomware'. More samples:)

Old samples - SentinelOne wrote a paper on MacOS.XLoader. Here are the samples:)

APT-C-59 paper + samples released today.

We've made an addition to the vx-underground WINAPI Tricks GitHub repository:

- Correct implementation of URLDownloadFileW using IBindStatusCallback callbacks to ensure remote file download was completed successfully

Check it out here: https://github.com/vxunderground/WinAPI-Tricks

New Babuk samples && new Mekotio Banker samples. Have a nice day.

Conti ransomware group has released a statement and apologized to "members of Saudi Arabia, UAE, and Qatar families ... to His Royal Highness Prince Mohammed bin Salman and any other members of the Royal Families"

We have archived it here: https://pastebin.com/eeLNnAG0

The long-term goal of vx-underground is to develop:

- Reliable front-end, doesnt concede dark art aesthetic, easy to navigate, works on mobile devices
- Ability for individual sample retrievable
- Enhanced papers library

Ideally completion date is sometime 2023.

We've added a new video to the vx-underground YouTube archives. The video archive shows Ukrainian authorities arresting cl0p ransomware operators in South Korea.

* vx-underground does not own the rights to this video
* archival purposes only
https://www.youtube.com/watch?v=R9MG7McrEO8