We will be offline for a few days.

BRB

We have released Notes from UG Volume 2: XOPALEHA.

Xopaleha is a blackmarket exploit dealer. We allowed members of our Discord to ask him anything.

You can check it out here: https://papers.vx-underground.org/papers/VXUG/Exclusive/Interviews/InterviewWithXopaleha.pdf

For our RE and Threat Intel friends:

We've added the Qakbot debugger leak. This debugger was accidentally dropped onto an infected machine in early November.

You can download it here: https://papers.vx-underground.org/archive/Builders/Qakbot%20Debugger.7z

We've updated the vx-underground leaked source code collection on our GitHub repository. We've added Android.Cerberus.K (advertised as v10).

* Potentially incomplete source code

You can check it out here: https://github.com/vxunderground/MalwareSourceCode/tree/main/Leaks

We've re-uploaded, re-indexed, and expanded our Conti ransomware group leak collection.

- Training material
- Operator leak
- TeamTNT tool leak

You can check it out here: https://share.vx-underground.org/

We've made updates to vx-underground

-All new additions are displayed on the homepage
-New papers added to AV Tech section
-Notes from UG is now named Threat Intel
-Threat Intel page lists ransomware group leaks and domains
and more...

Check it out here: http://vx-underground.org

New additions:

-MacOS.Macma samples
-Moses Staff samples
-North Korean TA406 samples
-Emotet samples
-Conti Ransomware Group analysis paper added
-Finding Beacons in the Dark: A Guide to Cyber Threat Intelligence by Blackberry added

Check it out here: https://www.vx-underground.org/

Cronrat malware sample:)

https://sansec.io/research/cronrat

RATDispenser samples:)

https://threatresearch.ext.hp.com/javanoscript-malware-dispensing-rats-into-the-wild/

Android.Cynos sample:)

https://news.drweb.com/show/?i=14360&lng=en

APT Tardigrade:) Paper + sample

Babadeda crypter samples:)

https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities

winamp source code still present on webarchive

BotenaGo IOT malware:)

APT31 SoWaT implant:)