vx-underground

The largest collection of malware source code, samples, and papers on the internet.

(Unofficial vx-underground telegram mirror. Maintained by Serhii (.dll / bezoodaog) (npub1j66…ehq4))

vxug.org: https://vx-underground.org
git: https://github.com/vxunderground
xitter: https://x.com/vxunderground
telegram: https://t.me/vxunderground

Last Notes

2026-10-30 05:14:47 UTC

- reply

Oh it's like online porno you read
wtf is bro a gooner

2026-10-30 05:09:36 UTC

Hi
I have been informed by a family member something called AO3 has been compromised.
Who compromised AO3? Why did they compromise AO3? If you're extorting AO3 currently can you give me specific things so I can give it to them?
They can't look at stuff and they're very sad

2026-10-27 20:31:26 UTC

Wow! Big news today!
Soon Discord messages will be indexable on Google. If you're in a public Discord which is discoverable, and has not changed its privacy settings, any messages posted moving forward can be found from search engines!
Hooray!!!!!1 (I think this is very bad)

2026-10-27 08:45:16 UTC

Hello, Little People Living Inside Of My Computer,
I have made my first YouTube video. I am bonking goop (malware) with a stick. I've tried to be both technical and non-technical to appeal to all nerds.
This was a lot of work. I love you.
https://www.youtube.com/watch?v=MqdR7eMqJnc

2026-10-14 04:14:18 UTC

> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "Our EDR picked up unusual activity on the network. It was flagged as CLOUDHAZE a/k/a UNC7072"
> ok
> gibs files
> literally nothing on CLOUDHAZE
> literally nothing on UNC7072
> listed as primarily targeting healthcare
> crickets
> tf is this goop?
> look inside
> Rust malware
> make quick initial assessment
> say has weird anti-emulation stuff
> be wildly inaccurate
> be a doofus
> post inaccurate information on internet
> prolly shouldnt write about bonking goop at 3am while sleep deprived
> nobody calls me out
> calling myself out rn for being doofus
> resume bonking
> malware only runs when command line arguments passed
> "--check" or "--check-gui"
> if no command line, dies
> ok
> keep looking
> malware has bunch of stuff inside
> deobfuscates stuff inside itself
> dynamically builds C2 domains
> connects to C2 domains via HTTPS
> sends POST
> emulate
> goop does its thing, connects to C2
> authenticates
> radio silence
> operators likely watching and waiting
> goop doesnt automatically deliver more goop
> ok
> keep digging
> goop can accept commands from operator
> create process and redirect I/O
> read files
> likely has campaign ID associated with it internally
> dm goop giver back
> lol r u in healthcare bro?
> "No, I work for a large Oil and Gas company in Europe"
> company v v valuable to EU for strategic reasons since Ukraine Russia conflict
> hmmmm
Chat, I'm absolutely stumped. I have no clue what the actual fuck I'm looking at. I don't know if this state-sponsored malware, or a really dedicated financially motivated Threat Actor who cares deeply about their operational success. State-sponsored malware would align with potential motives for espionage. However, it would also align for a financially motivated Threat Actor who could make immense money if a compromise was successful.
I wish I could allocate more time to bonking this malware, unfortunately more malware needs bonking. Maybe someone else can pick up on this, a colleague, company, some stinky nerd, whoever or whatever.
C2s:
topsmagnificentgrade(.)com
tabbyottercub(.)com
flawlessgradecheered(.)com
Stager:
7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3
Payload:
74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124
Unusual strings I don't understand:
- "Caira"
- "GUJONQGNQCLYEYJ"
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/437/317/648/345/679/original/a8506ffce54e37a0.jpg

2026-10-06 16:15:23 UTC

> be me
> get DM
> "smelly i made a small vx-underground video game"
> ???
> "It's a WASD VXUG explorer. The entire VXUG library is walkable and explorable in a Gothic themed environment. The malware library cat (Pica) walks around with you as you explore the malware corpus. You can review samples, code, papers"
> ???
> sends video
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/394/854/588/562/073/original/3c5dc3f0db0282dd.mp4

2026-10-06 04:51:42 UTC

- reply

It's actually kind of funny. I didn't even know GitHub banned us.
Someone sent me a DM about an active malware campaign on GitHub, when I went to check it out I couldn't even view public-facing repositories.
That is how I learned I got banned.
By investigating malware on their platform

2026-10-06 04:36:13 UTC

Hello
Unfortunately, GitHub has banned us. They have orbital nuked the entire malware source code collection.

2026-09-24 15:09:37 UTC

Big news for malware enthusiasts: I've uploaded an additional 170,000+ malwares to the internet
Bigger news for silly pictures of cats enthusiasts: I've attached one to this post
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/326/648/282/691/200/original/33f02b4456ed32e5.jpg

2026-09-24 04:37:03 UTC

Hello, Little People Living Inside My Computer,
I have made a YouTube account to discuss malware reverse engineering and development. It will primarily target noobs. It will be lighthearted, poorly produced, and spontaneous.
https://www.youtube.com/@MalwareForFun

2026-09-22 20:21:58 UTC

- reply

crime is illegal and for nerds. this is bad and it is criminal. don't compromise the fbi and extort them. that is bad

2026-09-22 20:16:51 UTC

fbi job portal defaced and compromised? oh yeah, it's a silly tuesday
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/316/531/739/786/887/original/6e005dcbc7bac984.mp4

2026-09-17 03:10:28 UTC

You're all a bunch of God damn degenerates and you CANNOT be trusted.
I asked if anyone had any video requests (implying the subject would be malware), because I'm beginning to find video creation kind of fun, and everyone immediately just starts talking about making videos about femboys and documentaries about cats
I don't even know why I ask you stinky nerds anything
Pic unrelated
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/284/184/296/981/208/original/abbd67f922fb2653.jpg