vx-underground

2022-05-16 14:39:18 We've updated the Windows Malware paper collection

-SERVICE_FAILURE_ACTIONSW Exception for Persistence
-Microsoft Office HTML Editor for Persistence
-Persistence via Java Environment Variables
-Demonstrating Reflective DLL Loading - KaynLdr

https://vx-underground.org Открыть/Комментировать

2022-05-16 13:05:10 Lockbit ransomware group has ransomed a hospital in Mexico.

This is the 2nd hospital Lockbit has ransomed recently.

NOTE: This is the healthcare sector of the local government of Morelos which aids hospitals and coordinates healthcare with civilians. This is not a hospital directly. Открыть/Комментировать

2022-05-15 22:33:14 Later this week we will be launching a Twitter bot which gives in-real-time updates to "dark web" domains. This bot will be free (obviously) and it based off of the open-source framework developed by ThetaNet.

List of groups it will monitor are listed in the attached image.

If you'd like to create your own bot for your business, hobbies, or ??? you can check out ThetaNet's "ransomwatch" repository on GitHub here: https://github.com/thetanz/ransomwatch

NOTE: vx-underground is NOT going into the Threat Intelligence business. We are NOT "making a statement", or trying to interfere with any other organization. We are providing the bot "as-is".

tl;dr easier than checking the domains manually Открыть/Комментировать

2022-05-15 21:38:00 We receive this question every day, sometimes multiple times a day. Открыть/Комментировать

2022-05-15 17:12:40 We've made some updates to vx-underground

*New APT samples from the month of May
*Correction of APT names in 2016
*New Windows Malware papers: "About XLL Phishing" and "From Process Injection to Function Hijacking"

Have a nice day.

Check it out here: https://vx-underground.org Открыть/Комментировать

2022-05-15 07:14:01 Download malware Открыть/Комментировать

2022-05-14 18:22:58 Conti has updated their message to Costa Rica Открыть/Комментировать

2022-05-14 17:06:37 Открыть/Комментировать

2022-05-14 16:11:58 Conti ransomware group continues to mock and taunt the entire country of Costa Rica. Conti also calls the Biden administration terrorists. Открыть/Комментировать

2022-05-14 08:03:43 Открыть/Комментировать