vx-underground
Open in Telegram
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
Show moreπ Analytical overview of Telegram channel vx-underground
Channel vx-underground (@vxunderground) in the English language segment is an active participant. Currently, the community unites 55 189 subscribers, ranking 1 741 in the Technologies & Applications category and 654 in the USA region.
π Audience metrics and dynamics
Since its creation on Π½Π΅Π²ΡΠ΄ΠΎΠΌΠΎ, the project has demonstrated rapid growth, gathering an audience of 55 189 subscribers.
According to the latest data from 10 June, 2025, the channel demonstrates stable activity. Although there has been a change in the number of participants by 8 644 over the last 30 days and by 0 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 17.26%. Within the first 24 hours after publication, content typically collects 10.81% reactions from the total number of subscribers.
- Post reach: On average, each post receives 9 526 views. Within the first day, a publication typically gains 5 966 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 191.
- Thematic interests: Content is focused on key topics such as nerd, bubble, cybersecurity, threat, healthcare.
π Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
βThe largest collection of malware source, samples, and papers on the internet.
Password: infected
https://vx-underground.org/β
Thanks to the high frequency of updates (latest data received on 18 March, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
55 189
Subscribers
No data24 hours
-137 days
+8 64430 days
Posts Archive
55 189
tl;dr rich crypto guy kidnapped, tortured, almost murdered. kidnapped demands the password, italian guy says fuck you
May 23rd, 2025, the New York Police Department, in the United States, released details on a cryptocurrency holder who was tortured for almost 3 weeks.
The unidentified victim, a 28 year old man from Italy, was kidnapped by John Woeltz (37) and Beatrice Folchi (24). Mr. Woeltz is a self-described cryptocurrency investor who rents a $40,000/month apartment in Manhattan.
For nearly 3 weeks Mr. Woeltz demanded credentials to the unidentified victims crypto assets. The victim refused.
Mr. Woeltz tied the victim with electrical cords, repeatedly used a taser while the victims feet were submerged in water, beat him, pistol whipped him, forced the victim to ingest narcotics, and repeatedly wielded an electric chainsaw to the victim asserting he would dismember him if he did not give Mr. Woeltz the credentials to his crypto assets. The victim received a large wound on one of his arms where Mr. Woeltz used the chainsaw against the victim. Mr. Woeltz also tied an Apple AirTag around the victims neck if the victim tried to escape.
The victim is believed to possess millions in various cryptocurrencies.
During the kidnapping Mr. Woeltz took photos of the victims with a polaroid camera with the intent on sending the photos to the victims friends or family.
Thankfully, and although details are scarce, the victim managed to escape Friday, May 23rd, the day in which the victim reported to police he would have been murdered.
Police reported that, upon entry to Mr. Woetlz apartment, they discovered a "blood-shoaked makeshift torture chamber".
55 189
In all seriousness, the cat was found on the street. The cat tried to scratch one the police officers. They decided to take a mug shot of the cat for "Assault" on a police officer, but the photo is designed to help finder the cats owner
55 189
+1
Thai police have apprehended a violent criminal operating under the moniker Nub Tang
55 189
Hello,
This is your semi-daily reminder that we are super-AFK. Despite our absenteeism we are still ingesting data. However, things are not being pushed to prod. Here is where we currently are:
1. Bradley and I are still AFK. He is acting as his Father's primary caretaker due to poor health. I am busy dealing with a newly deployed human being (baby was born).
2. We are still ingesting malware despite being gone thanks to @petikvx. Our backlog is colossal, millions upon millions of malware samples in queue for prod.
3. We did an oopsie, we allocated 20TB of storage on our servers and we exceeded that. We have allocated an additional 20TB, but it isn't properly configured (yet). Hence, we have millions of malware samples floating in limbo waiting for their final resting place... but it doesn't exist yet (kind of). If I can get more time away from my newly created human being then I can finalize the configurations for new malware being pushed. I don't know when I can do that. My free time is random and is primarily used for screaming in the restroom or sleeping.
4. We have continued paper ingestion. As said in bulletin point three, we have the stuff but we don't have the science. When I have free time I will push tons of cool papers.
5. There is something else I intended to announce and share here during my spare time. I can't remember it right now, but I'm sure it was cool and interesting. If I can remember it I'll post about it.
I hope everyone had a good week and has a good weekend.
Thanks,
- smelly
55 189
Today law enforcement agencies across the globe decided to meme the Threat Actors behind DanaBot. The multi-agency operation decided to announce the takedown, and indictments, by releasing an anime trailer π
55 189
> qakbot dude indicted
> lumma stealer memed by feds
> lumma stealer taken down
> coinbase hacked
> ransomware group releases edgy video
> cryptothieves got rico charges
> new cool malware research
yo CHILL OUT. just STOP. timeout. pause. WAIT a second
55 189
There is my detailed report on Operation Endgame. I couldn't have gotten more exact figures, attached some pictures, and made the post longer. But I've got a newborn baby heap spraying milk out his face and I'm just standing in the corner, on my phone, in terror as more mature people in my home deal with the situation
55 189
Some governments did a thing and fucked up Lumma stealer, they seized like, I don't know, a bunch of stuff and sent customers messages about something scary
55 189
Chat, I'm going to be that guy for a second.
Maybe, and this is just speculation, but just maybe it was a poor decision by Coinbase to out source labor to 3rd world South Asian workers whom they exploit momentarily?
What if Coinbase hired people, treated them well, and didn't exploit them monetarily? Hmmmmm?
Maybe someone is more likely to accept a bribe when a multi million dollar company is only paying them $70/month - $160/month
55 189
smh took christmas off then went back to crime. some ppl got zero holiday spirit fr
55 189
Coinbase was compromised December 26th, 2024. Initially it was reported they were compromised in early to mid-May.
The (to the best of our knowledge) unidentified Threat Actors(s) maintained persistent access for nearly 6 months.
55 189
Politics aside β will this impact the cybercrime ecosystem? If the Russian Federation establishes a friendship with the United States, will we see an impact on ransomware groups?
55 189
+1
VMPSoft has been DMCA-ing YouTube videos which show how to combat malware payloads abusing VMProtect
55 189
Hello,
For the past 6 years I've had people ask I will be attending DEFCON. The answer is still: No. However, I may make an appearance at DEFCON 35 or DEFCON 36. It will also be the first cybersecurity conference I've ever attended. Cool beans
Thanks,
- smelly smellington
