vx-underground
We've solved the mystery. Who's That Pokemon? It's CastleRAT a/k/a TAG-150! Okay, here is the drama and scoop, or whatever. I don't know if anyone cares, but this has been a really interesting puzzle with lots of twists and turns. Previously malwrhunterteam…
More information about Threat Actor Group (TAG) 150:
https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
Recordedfuture
From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure
Insikt Group reveals TAG-150’s multi-tiered infrastructure and CastleRAT malware—an advanced threat actor evolving rapidly with stealth and scale.
❤27🤔9
Big news coming later today. It'll be the slopocalypse.
I don't feel like writing about it right now, because I'm tired from a teething baby with sleep regression, but basically all these fucking AI vibe coders are using Firebase and like, 22,000,000 records are exposed, or something, an outrageously high number.
Also, a disgustingly high amount of people trying to use AI for CSAM.
It's not my research, it's someone else's, but I want to give them a proper shout out and explanation of their work.
I cannot stress this enough: DO NOT TRUST VIBE CODERS. DO NOT DO IT. AI CODE IS NOT SECURE. DO NOT DO IT. STOP THE SLOP.
I don't feel like writing about it right now, because I'm tired from a teething baby with sleep regression, but basically all these fucking AI vibe coders are using Firebase and like, 22,000,000 records are exposed, or something, an outrageously high number.
Also, a disgustingly high amount of people trying to use AI for CSAM.
It's not my research, it's someone else's, but I want to give them a proper shout out and explanation of their work.
I cannot stress this enough: DO NOT TRUST VIBE CODERS. DO NOT DO IT. AI CODE IS NOT SECURE. DO NOT DO IT. STOP THE SLOP.
❤78🫡18🤓11🤔5😢4💯4👍3🥰2🔥1🤯1
It's the slopocalypse.
OSINT nerd Harrris0n has created "Firehound". He (or others, I don't know) have begun the daunting task of hunting AI slop in the Apple app store.
They have identified (as of this writing) 198 iOS apps which leak information on users (in some capacity). Unsurprisingly, the top are all related to AI.
The top currently leaking user data is "Chat & Ask AI by Codeway" which has exposed 18M users information including:
- Name
- Email
- Creation date
- Messages (sent, received, content, etc)
- Voice chats
... anything you've said to this AI agent is exposed. It is 400,000,000+ messages... (Image 1, redacted)
Next up up on the slop-o-meter is "YPT - Study Group" which currently exposes over 2M users information including:
- AI tokens
- User ID
- User Key
- Chats (sent, received, content
This is all AI slop for things under education, entertainment, graphic design, health and fitness, "lifestyle", social networking, and more.
Some of the stuff is present is absurd. Harrris0n notes the presence of people doing CSAM (child pornography) related things with the AI agents. (tl;dr pedophiles identifying information currently leaking online) ... as well as "LooksMaxxing" stuff (???).
It's an infinite blackhole of user personable identifiable information, beside just names, emails, etc, but also their personal conversations with AI agents.
It's the slopocalypse.
See for yourself:
https://firehound.covertlabs.io/
OSINT nerd Harrris0n has created "Firehound". He (or others, I don't know) have begun the daunting task of hunting AI slop in the Apple app store.
They have identified (as of this writing) 198 iOS apps which leak information on users (in some capacity). Unsurprisingly, the top are all related to AI.
The top currently leaking user data is "Chat & Ask AI by Codeway" which has exposed 18M users information including:
- Name
- Creation date
- Messages (sent, received, content, etc)
- Voice chats
... anything you've said to this AI agent is exposed. It is 400,000,000+ messages... (Image 1, redacted)
Next up up on the slop-o-meter is "YPT - Study Group" which currently exposes over 2M users information including:
- AI tokens
- User ID
- User Key
- Chats (sent, received, content
This is all AI slop for things under education, entertainment, graphic design, health and fitness, "lifestyle", social networking, and more.
Some of the stuff is present is absurd. Harrris0n notes the presence of people doing CSAM (child pornography) related things with the AI agents. (tl;dr pedophiles identifying information currently leaking online) ... as well as "LooksMaxxing" stuff (???).
It's an infinite blackhole of user personable identifiable information, beside just names, emails, etc, but also their personal conversations with AI agents.
It's the slopocalypse.
See for yourself:
https://firehound.covertlabs.io/
firehound.covertlabs.io
Firehound | Security Operations
Industrial management platform for Firehound-Go scans.
🤣53🔥12🥰7❤5👏4😱4
vx-underground
It's the slopocalypse. OSINT nerd Harrris0n has created "Firehound". He (or others, I don't know) have begun the daunting task of hunting AI slop in the Apple app store. They have identified (as of this writing) 198 iOS apps which leak information on users…
I deleted previous post and decided to do a mini-write-up for people too lazy to explore themselves, provide key insights, and also give Harrris0n credit for his work.
❤54🔥1
vx-underground
It's the slopocalypse. OSINT nerd Harrris0n has created "Firehound". He (or others, I don't know) have begun the daunting task of hunting AI slop in the Apple app store. They have identified (as of this writing) 198 iOS apps which leak information on users…
Look at this and tell there is a God
https://gist.github.com/vxunderground/52cd17f363f83792243be814c1e85b30
https://gist.github.com/vxunderground/52cd17f363f83792243be814c1e85b30
Gist
Sample information
GitHub Gist: instantly share code, notes, and snippets.
😢37🥰14😱11❤5🙏4😁1😎1
I've been receiving messages from both Lockbit ransomware group and ALPHV ransomware group for months.
I've been so preoccupied with my newborn son I thought it was an imposter.
They've been trying to tell me stuff, and I just kept sending cat pictures. They eventually gave up and started replying with pictures of cats too.
¯\_(ツ)_/¯
I've been so preoccupied with my newborn son I thought it was an imposter.
They've been trying to tell me stuff, and I just kept sending cat pictures. They eventually gave up and started replying with pictures of cats too.
¯\_(ツ)_/¯
🤣169❤34🥰20🔥1
Today ALPHV ransomware group (who swears they've never rebranded) informed me they've made a new ransomware group with a new and cool and badass name.
I learned a few things.
1. ALPHV follows me on social media. They pay attention to my posts (including kitty cat pictures).
2. ALPHV informed me that they're no longer going to use TOR for ransomware leaks or negotiations because "the FBI can fuck it". Instead everything they do will be stored on the blockchain.
Using the blockchain for malware, and malware accessories, isn't a new malware concept, however it is a relatively ... rare ... or more exotic TTP. If my memory serves me correctly (which it rarely does), the North Korean government has used cryptocurrency blockchains for malware delivery mechanisms and C2 persistence.
They told me they'll be using ICP (Internet Computer Protocol) blockchain.
I initially thought they meant "Insane Clown Posse" blockchain. For a brief moment in time I thought the Juggalos were getting involved in ransomware.
I'm not a cryptocurrency nerd, but they said they use ICP blockchain because ICP can "run smartcontract on server". I have no idea what this means.
What does all of this mean? I don't know. I've been out of the loop on cybercrime TMZ.
I learned a few things.
1. ALPHV follows me on social media. They pay attention to my posts (including kitty cat pictures).
2. ALPHV informed me that they're no longer going to use TOR for ransomware leaks or negotiations because "the FBI can fuck it". Instead everything they do will be stored on the blockchain.
Using the blockchain for malware, and malware accessories, isn't a new malware concept, however it is a relatively ... rare ... or more exotic TTP. If my memory serves me correctly (which it rarely does), the North Korean government has used cryptocurrency blockchains for malware delivery mechanisms and C2 persistence.
They told me they'll be using ICP (Internet Computer Protocol) blockchain.
I initially thought they meant "Insane Clown Posse" blockchain. For a brief moment in time I thought the Juggalos were getting involved in ransomware.
I'm not a cryptocurrency nerd, but they said they use ICP blockchain because ICP can "run smartcontract on server". I have no idea what this means.
What does all of this mean? I don't know. I've been out of the loop on cybercrime TMZ.
🥰65😁29❤10😎10😢3❤🔥1👍1
This media is not supported in your browser
VIEW IN TELEGRAM
Yes, Dmitry Yuryevich Khoroshev, the alleged leader of Lockbit ransomware group, FBI Most Wanted, and sanctioned by the United States Department of Treasury, was attempting to contact me online.
For months I believed him to be an imposter.
This is what I kept sending him:
For months I believed him to be an imposter.
This is what I kept sending him:
🥰101❤23😁11👏7🤔3❤🔥2🔥1😱1😢1
vx-underground
Yes, Dmitry Yuryevich Khoroshev, the alleged leader of Lockbit ransomware group, FBI Most Wanted, and sanctioned by the United States Department of Treasury, was attempting to contact me online. For months I believed him to be an imposter. This is what I…
> be Dmitry Yuryevich Khoroshev
> bounty of $10,000,000 by FBI
> believed to possess of $4,000,000,000 as a result of criminal extortion
> linked to botnets, money laundering, the russian government, bullet proof hosting
> tries to contact me
> send weird cat videos
imagine unironically being like, a fucking cyber cartel boss and some fucking retard american just keeps sending you cats
> bounty of $10,000,000 by FBI
> believed to possess of $4,000,000,000 as a result of criminal extortion
> linked to botnets, money laundering, the russian government, bullet proof hosting
> tries to contact me
> send weird cat videos
imagine unironically being like, a fucking cyber cartel boss and some fucking retard american just keeps sending you cats
❤112🤣102🥰28🎉9😁6🔥5❤🔥1👏1🫡1
This one year old post has been bothering me.
I felt great discomfort someone hasn't been demented enough to do HTTP stuff as close to the metal as possible with the Windows sockets API (in regards to malware stuff).
I'm not done yet, this code is ... sort of(?) ... in a debug state.
This code connects to HTTPBin, performs a TLS handshake, verifies the web certificate, then performs a simple HTTP GET. The way my code is organized the stage is set to perform HTTP POST to demonstrate data exfiltration to a remote HTTP host.
The next step is basically taking a file, reading it to memory, then uploading it to a remote host and ensuring it was received successfully.
Following the completion of the HTTP post, I'll transform the entire code base into being more position independent. In other words, trying to recreate Windows APIs (like QueryContextAttributesW) to avoid unnecessary (not really "unnecessary", but less hooking opportunities, looks unusual) abstractions. I'll also manually recreate GetProcAddress and do string hashing because ???
When I'm done with this low-level Windows socket C HTTP post example, this code base will probably be well over 3,000 lines of code.
tl;dr 3,000 lines of C or 12 lines of Python code (I tested it, it's literally 12 lines of Python code).
The code so far:
https://gist.github.com/vxunderground/f55edb02b0dbda148f9a3b88669b23c8
I felt great discomfort someone hasn't been demented enough to do HTTP stuff as close to the metal as possible with the Windows sockets API (in regards to malware stuff).
I'm not done yet, this code is ... sort of(?) ... in a debug state.
This code connects to HTTPBin, performs a TLS handshake, verifies the web certificate, then performs a simple HTTP GET. The way my code is organized the stage is set to perform HTTP POST to demonstrate data exfiltration to a remote HTTP host.
The next step is basically taking a file, reading it to memory, then uploading it to a remote host and ensuring it was received successfully.
Following the completion of the HTTP post, I'll transform the entire code base into being more position independent. In other words, trying to recreate Windows APIs (like QueryContextAttributesW) to avoid unnecessary (not really "unnecessary", but less hooking opportunities, looks unusual) abstractions. I'll also manually recreate GetProcAddress and do string hashing because ???
When I'm done with this low-level Windows socket C HTTP post example, this code base will probably be well over 3,000 lines of code.
tl;dr 3,000 lines of C or 12 lines of Python code (I tested it, it's literally 12 lines of Python code).
The code so far:
https://gist.github.com/vxunderground/f55edb02b0dbda148f9a3b88669b23c8
🥰24🤔7👏4❤3🤯2🤓2
My baby boy is the difficult age where he is learning several things simultaneously:
- How to grow teeth
- How to crawl
- Proto-communication
If you've never had a child, around 7 - 9 months (or later, each baby is different, but that's the average-average) babies will begin proto-communication.
They've picked up on people talking, and communicating back and forth, they understand the concept of sentence structure and vocal inflection being indicative of a question. They—understand—you—pausing—between—words, or pausing and waiting for someone to reply back verbally.
My baby boy now tries to join in conversations because he doesn't want to feel left out. He doesn't understand we're having a conversation, he doesn't even understand words, but he understands the "prototype of communication", hence now, seemingly out of nowhere, he inserts himself into our conversations by screaming like a psychopath and babbling incoherent nonsense.
He favorite "word" is blowing raspberries (pressing your lips together and blowing) and "ge-ge-ge" (think of the GE in "geese") or quite literally screaming as loud as he can.
Another interesting thing about proto-communication is he tries to initiate conversations now. Unfortunately, he does not possess manners. Additionally, he does not respect me as a person, place, or thing. This results in him attempting to start conversations with me, while I'm asleep, at 3 in the morning.
It's very interesting watching my baby boy grow. I remember when my wife first got pregnant and we confirmed the pregnancy visually via ultrasound. He was tiny, probably no greater than the size of a pea. His fetus kind of looked like a little sea horse, or something, and under the ultra sound we could see his little heart beating.
Now we look at him. He is much larger than a pea. He no longer looks like a sea horse (thankfully). He is screaming in my face at 3 in the morning because he wants to "talk". If he isn't screaming at my face at 3 in the morning, he's practicing his hand-eye coordination by trying to feed himself ... by putting food all over his face ... or in his pants ... or in his hair ...
As difficult as it can be being a parent, and as much as you "suffer", there is something oddly rejuvenating about the experience and it somehow (in ways I don't understand yet) makes you feel young again.
- How to grow teeth
- How to crawl
- Proto-communication
If you've never had a child, around 7 - 9 months (or later, each baby is different, but that's the average-average) babies will begin proto-communication.
They've picked up on people talking, and communicating back and forth, they understand the concept of sentence structure and vocal inflection being indicative of a question. They—understand—you—pausing—between—words, or pausing and waiting for someone to reply back verbally.
My baby boy now tries to join in conversations because he doesn't want to feel left out. He doesn't understand we're having a conversation, he doesn't even understand words, but he understands the "prototype of communication", hence now, seemingly out of nowhere, he inserts himself into our conversations by screaming like a psychopath and babbling incoherent nonsense.
He favorite "word" is blowing raspberries (pressing your lips together and blowing) and "ge-ge-ge" (think of the GE in "geese") or quite literally screaming as loud as he can.
Another interesting thing about proto-communication is he tries to initiate conversations now. Unfortunately, he does not possess manners. Additionally, he does not respect me as a person, place, or thing. This results in him attempting to start conversations with me, while I'm asleep, at 3 in the morning.
It's very interesting watching my baby boy grow. I remember when my wife first got pregnant and we confirmed the pregnancy visually via ultrasound. He was tiny, probably no greater than the size of a pea. His fetus kind of looked like a little sea horse, or something, and under the ultra sound we could see his little heart beating.
Now we look at him. He is much larger than a pea. He no longer looks like a sea horse (thankfully). He is screaming in my face at 3 in the morning because he wants to "talk". If he isn't screaming at my face at 3 in the morning, he's practicing his hand-eye coordination by trying to feed himself ... by putting food all over his face ... or in his pants ... or in his hair ...
As difficult as it can be being a parent, and as much as you "suffer", there is something oddly rejuvenating about the experience and it somehow (in ways I don't understand yet) makes you feel young again.
🥰74❤22💯4👍1😢1
vx-underground
My baby boy is the difficult age where he is learning several things simultaneously: - How to grow teeth - How to crawl - Proto-communication If you've never had a child, around 7 - 9 months (or later, each baby is different, but that's the average-average)…
Okay, I'm done schizo ranting about being a Dad.
Back to your regularly scheduled programming of malware and kitty cats.
I just wanted to share this with someone, even if it means screaming into the void of the internet, because I don't have many friends in real life anymore who I can schizo rant about stuff to (I'm old).
Back to your regularly scheduled programming of malware and kitty cats.
I just wanted to share this with someone, even if it means screaming into the void of the internet, because I don't have many friends in real life anymore who I can schizo rant about stuff to (I'm old).
❤🔥59❤17🥰9😁3🤓3💯2🙏1
I was watching this YouTube video of this Russian dude who traveled to North Korea to go sightseeing.
North Korea is notoriously strict on what visitors can and cannot do. Throughout most of the trip he risked his own safety by illegally filming around North Korea on his cell phone.
At one point during the trip he managed to sneak away from his appointed North Korean tour guide. He approached a group of people sitting down, ... just kind of hanging around ..., doing something.
They were very friendly to him.
During the conversation he asked them what they'd like to do in the future. One of the men said, "I hope some day to travel. I really want to see Yugoslavia"
The fuckin' Russian guy looked at him like this when he said "Yugoslavia"
North Korea is notoriously strict on what visitors can and cannot do. Throughout most of the trip he risked his own safety by illegally filming around North Korea on his cell phone.
At one point during the trip he managed to sneak away from his appointed North Korean tour guide. He approached a group of people sitting down, ... just kind of hanging around ..., doing something.
They were very friendly to him.
During the conversation he asked them what they'd like to do in the future. One of the men said, "I hope some day to travel. I really want to see Yugoslavia"
The fuckin' Russian guy looked at him like this when he said "Yugoslavia"
🥰28😁21😢6❤5🤯4
vx-underground
I was watching this YouTube video of this Russian dude who traveled to North Korea to go sightseeing. North Korea is notoriously strict on what visitors can and cannot do. Throughout most of the trip he risked his own safety by illegally filming around North…
how-do-we-tell-him-mr-krabs.gif
77.3 KB
For those who don't get it because they're unfamiliar with Europe, or history, or live under a rock like Patrick Star: Yugoslavia hasn't existed since 1992.
🥰20😢6😁3🎉3❤2🔥2🤔2