I've made so many updates to vx-underground (while simultaneously schizo posting), it cannot fit in a single post without it looking like garbage.

Here is a PasteBin link with the latest updates from the past 10 days (it's a lot)

https://pastebin.com/raw/EsErG6uV

In case you missed it, I'm aiming to collect every publicly released malware analysis paper (ever) and link it with the corresponding files listed in the paper. At my current pace it's going to take me about 3 years and 4 months to do everything from 2007 - present

Orange,

I saw your email and I love it. This is great stuff. I'm probably not going to be on my computer for the rest of the day, but I'm super excited to share it tomorrow morning. I love you so much for this stuff.

Thanks,
- smelly

Loteria de Medellin (the Lottery of Medellin, Columbia) has allegedly been compromised by Crimson Collective

They claim over 1TB of data have been exfiltrated.

They've released samples of drivers licenses, applications, etc.

Insert Dragon Ball Z reference

Fixed this. Initially I wrote Medellin, Spain

For some reason I confused Medellin, Columbia for Madrid, Spain

I've got a very high IQ, it's (falling) off the charts

Spelled Colombia wrong

Fuck it, close enough. I'm going back to bed

My Xitter For You tab was curated fairly well. It was a nice combination of cat pictures, information security news, and a sprinkle of politics

Today my For You is Steve Jobs daughter, big breasted women, and Twitch streamers

Wtf is this shit? Give me my cats back

Yeah, I'm killing myself tonight

Tldr guy says telling someone how much RAM you have is a security issue. Fucking ridiculous.

Chat, we are so back.

"Orange" leaked the Islamic Revolutionary Guard Corps (IRGC) malware source code for "BellaCiao". BellaCiao has been discussed by various Cyber Threat Intelligence agencies.

This includes "Variant 1", "Variant 2", and documentation on how it works

"Episode 3" is fuckin' cookin' bro. I don't know Persian, but I know code and understand silly documentation pictures.

https://github.com/KittenBusters/CharmingKitten

I'm not a forensics expert. I couldn't forensic my way out of a forensics thing.

However, this cyber weapon thingy leaked from the Iranian government has a program debug file thingy and it contains a debug file path

What could it mean?

Myself personally, whenever I am performing a state-sponsored campaign to infiltrate a foreign adversary of the government in which I reside, I too name the directory structure after our primary target.

This makes it easier for me to remember who our Commander has instructed us to target. Furthermore, in the event of a compromise or whistleblower, analysts whom are employed by our foreign adversaries can easily identify our objectives and modus operandi

TIL "Bella Ciao" is an anti-Nazi and anti-fascist Italian folk song.

The Iranian government named their malware payload "Bella Ciao".

Reddit-bro goes on schizo rant about how anti-malware services are garbage. In the middle of schizo rant he writes that his 1337 hack is allocating memory in a target process and running calc.exe

WHY ISNT THE AV DETECTING CALC BRO

https://www.reddit.com/r/antivirus/comments/1o4nq5o/the_shocking_state_of_premium_antimalware/

WHY ISNT IT FLAGGING MEMORY ALLOCATION INVOCATIONS?! MEMORY ALLOCATION IS ILLEGAL AND FOR NERDS