Conti ransomware group has released a statement and apologized to "members of Saudi Arabia, UAE, and Qatar families ... to His Royal Highness Prince Mohammed bin Salman and any other members of the Royal Families"

We have archived it here: https://pastebin.com/eeLNnAG0

The long-term goal of vx-underground is to develop:

- Reliable front-end, doesnt concede dark art aesthetic, easy to navigate, works on mobile devices
- Ability for individual sample retrievable
- Enhanced papers library

Ideally completion date is sometime 2023.

We've added a new video to the vx-underground YouTube archives. The video archive shows Ukrainian authorities arresting cl0p ransomware operators in South Korea.

* vx-underground does not own the rights to this video
* archival purposes only
https://www.youtube.com/watch?v=R9MG7McrEO8

In 1996 a virus writer, suspected to be from either France or the United Kingdom, released the Tentacle virus. Tentacle II was the first virus to use EPO (Entry-Point Obscuring) infection for Windows 3.x systems.

This was the icon associated with the binary.

New video added to our YouTube archives:

Iranian news reports the Tehran subway disruption. Iranian authorities attributed the issue to 'overcrowding' and unidentified 'computer problem'.

This follows the cyber attack against Iranian gas stations.
https://www.youtube.com/watch?v=Vejsd_wYcO0

Europol has announced on November 4th they arrested 2 affiliates of REvil in Romania and an additional affiliate in Kuwait. They've also introduced the ANTI-REVIL Team.

Read the press release here:
https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged

We've updated the vx-underground APT collection:

-Zebra2104 samples
-Godzilla webshell, NGLite Trojan
-New TA2722 samples

https://vx-underground.org/apts

* Unable to locate KdcSponge samples

We have aggregated a sample of Lazarus Groups trojanized IDA Pro installer.

Download: https://vx-underground.org/apts
More info: https://mobile.twitter.com/ESETresearch/status/1458438155149922312

Total malware samples in the vx-underground malware collection: 6,121,742

Goal: 26,000,000

We have re-indexed the Conti ransomware group content leak.

-"Crack 2019"
-"Metasploit US/RU"
-"Network Pentesting"
-"Cobalt Strike"
-"Powershell for Pentesters"
and more...

You can check it out here: https://vx-underground.org/archive

Leaked footage of the GRU (Главное Разведывательное Управление) successfully backtracking an attackers IP address using IPCONFIG and Windows XP.

Yes, it is the Internet Café.

We've added a new proof-of-concept to the vx-underground paper collection: Keylogging using NtUserGetRawInputData by smelly__vx


-Resolves NTDLL / WIN32U APIs on load
-Function hashing
-Random string generation
-No outbound connectivity

https://github.com/vxunderground/VXUG-Papers/blob/main/NtUserGetRawInputDataKeylogger.cpp

We've renamed the WINAPI-Tricks GitHub repository to VX-API.

Adds:
-Templates, demonstrating various entry points and using a custom entry point on Windows in C/C++
-STDIO directory is now StringsAndData. New functions have been added.

More to come...
https://github.com/vxunderground/VX-API

We've added a new paper to the vx-underground paper collection: "Protecting your malware with BlockDLL.B" by smelly__vx


This is an pseudo-functionless adaptation of _xpn_'s "Protecting Your Malware with blockdlls and ACG"

You can check it out here: https://github.com/vxunderground/VXUG-Papers/blob/main/BlockDlls.b.cpp

I apologize - we are behind schedule on APT additions. Lots of stuff happening behind the scenes.

Paper + samples:

2021.11.10(1) - Lazarus Nukesped
2021.11.17 - Alert (AA21-321A) Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities