5hid

Today Reuters reported that Spanish authorities arrested the leader of KillSec ransomware group. He is 16 years old. Who are these people bro? When I was 16 I was being a nerd and doing malware stuff, but I also was doing stuff like talking to girls, learning how to drive, going to school events, etc. How are you going to do international cybercrime at 16? You're only a kid once, enjoy being a kid and having some freedom. Go outside, touch some grass, hold a girls hand, throw a ball, look at silly pictures of cats. Pic unrelated

> get dm > "is this malware?" > look inside > malicious libre office macro > looks funny tho > raw shellcode > 2,0,1,187,192,168,45,246 > malware tries connecting to IP address > 192.168.45.246:443 > malware delivered from a live website these dumb fucks vibe coded a malware payload and had it connect back to a local ip address. are they actually fucking retarded???

Oh, I forgot. One other thing. I had a few people say I should focus more on news. People said using keywords like "breaking" can improve engagement and potentially bring more people to this social media account. I appreciate the insight, feedback, and thoughtfulness. However, I am very much ... I don't know the word ... I guess I don't really give a fuck bro. Yes, people and monies and stuff is cool, but I don't want to be a slop account. I'm just going to continue doing what I'm doing. Malware source code, samples, and papers for free, forever. Cheers

"Hey smelly, I work for (company), we had a threat actor phish an employee and use ScreenConnect to get access to their computer. The Threat Actor then dropped a .exe on the computer. Our AV/EDR stopped it, but we don't know what it is. Do you want to see?" > yes, absolutely, give me goopies > give malware > download > look inside > position independent c code > points to section of memory > xor'd several times > un-xor's thingie in memory > creates process of random thingie > pauses process of random thinie > hollows out process > puts goopies it extracted from itself into it > resumes process > lol process hollowing from embedded payload > payload not in .exe section > payload in .rdata mixed with other stuff > omg w/e fine, make me work > run the goopie > bonk with stick > find thingie it hollowed out > grab the magic goop from it > yay > look inside > another .exe > ok, .exe has .exe hidden inside, runs random .exe and puts secret .exe inside it > look at secret .exe thingie > c#.net .exe > ok lol > look inside > has hidden .exe inside it > omfg why bro are you doing this to me > pull .exe out of hidden .exe (im on secret .exe two now) > dies > base64 encoded the .exe internally > omfg why bro > base64 decode second secret .exe internally > get the goopies > second .exe is actually .dll > heavily obfuscated c#.net > really annoying me now > check virustotal > second mystery .exe (actually .dll) never seen before > look inside more > sniff sniff > sniff sniff > PURE-RAT > attributed to suspected Vietnamese Threat Actor group > matches known tactics, techniques, and procedures of group > matches details from Trellix and Huntress > group still evolving > went from noobs to doing p good malware My Brother in Christ, your organization is (probably) being targeted by a known Vietnamese Threat Group

> get on social media > nerds arguing about anti cheats > nerds discuss antiviruses > "anti viruses shouldn't be in kernel mode" You are absolutely correct. Please have the anti-malware vendors migrate their detection engines to user-mode. Nothing bad could happen.

The entire AV, EDR, and SOC industry is a SCAM. Has your organization been a victim of ransomware? Start the computer in DEBUG MODE. DUH. Then simply delete the malware. It's as simple as that.

In a truly brilliant move, employees from DigitalMint and Sygnia, responsible for handling ransomware negotiations, were indicted for performing ransomware attacks under ALPHV ransomware group. - Kevin Tyler Martin, ransomware negotiator from DigitalMint - Ryan Clifford Goldberg, Digital Forensics and Incident Response manager from Sygnia - Unnamed co-conspirator-1 The motive, per court documents, were the individuals were motivated to "get out of debt". All 3 men began performing ransomware attacks in May, 2023 and continued performing ransomware attacks until on or around April, 2025. The attacks stopped when the United States Federal Bureau of Investigation approached Ryan Clifford Goldberg regarding the ransomware attacks. Unsurprisingly, Mr. Goldberg initially denied having any knowledge of the ransomware attacks. However, he cracked during the interview and placed the blame on the currently unnamed co-conspirator. He stated he was recruited by him. After the interview concluded, Mr. Goldberg and his wife purchased 1-way tickets to France (???). Unsurprisingly (again), he has been detained in France because he is not a citizen of France and France doesn't give a fuck about a non-citizen. Mr. Kevin Tyler Martin, currently residing in Texas, spoke in 2024 at a technology conference where he spoke about his experiences defending ransomware attacks and handling negotiations. Both Mr. Goldberg and Mr. Martin have been charged with: - Violation of the Hobbs Act (18 U.S.C. § 1951) x2 - Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 (x1) Under max penalty of law, Mr. Goldberg and Mr. Martin could face as long as 50 years in prison.