Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
2nd Edition GlitchZone RHC 320x100 2
2nd Edition GlitchZone RHC 970x120 2

Author: RHC Dark Lab

TeamViewer: Irregularity Detected in Internal IT Environment

TeamViewer, a leading company in the remote access and support software sector, has announced that it has detected an irregularity in its internal IT environment. This event has alarmed both the company and its customers, who are concerned about the security of their data. Discovery and Immediate Response The irregularity was discovered thanks to the continuous monitoring of internal systems by TeamViewer’s security team.  Upon identifying the unusual behavior, the company promptly activated its incident response team and implemented the prescribed emergency procedures. Product Environment Security One of the main concerns among customers is the potential compromise of the product environment and

RansomHub criminal hackers claim cyber attack on Coca Cola

Today, the RansomHub gang of cybercriminals claimed on their Data Leak Site (DLS) an IT attack on Coca Cola. We still do not know whether this cyber attack actually affected Coca Cola’s IT infrastructure, since there is still no press release about the incident on their corporate site. In the post published underground by the RansomHub cybercriminals, it is reported that the gang is in possession of 800GB of data, exfiltrated from the company’s IT infrastructure. They threaten publication in seven days. There is also a countdown on the gang’s site showing that in 7 days and 16 hours, when there will

Threat Actor “DragonForce” Seeks New Partners 

A recent post on a dark web forum reveals that a cybercriminal group known as “DragonForce” is actively seeking new partners to join their Ransomware-as-a-Service (RaaS) operation. This recruitment drive is aimed at expanding their capabilities by incorporating specialists from various fields, particularly access specialists and pentesters, or teams of pentesters. Recruitment Details According to the post, DragonForce is offering an attractive partnership deal to entice skilled individuals and teams: Operational Capabilities The post highlights several key features of DragonForce’s operation that are designed to support their partners: Organizational Structure DragonForce operates with a defined organizational structure, maintaining a hierarchical system to

Threat Actors 888 claimed a compromise at Credit Suisse

A malicious actor, known by the alias 888, has recently claimed to be selling sensitive data belonging to Credit Suisse, one of the leading institutions in private banking and asset management. Details of the Alleged Breach According to 888, the breach allegedly occurred in 2024 and led to the compromise of a wide range of sensitive data belonging to Credit Suisse. The original post, published on a dark web forum, indicated that the stolen data included detailed information about clients and employees, such as: 888 also reportedly provided a sample of the stolen data to demonstrate the authenticity of the breach. In

Cyber ​​catastrophe in sight? The new Bug on MOVEit has an Online PoC Exploit

In the realm of cybersecurity, vulnerabilities constantly represent a significant risk for businesses and institutions. Many system administrators may recall CVE-2023-34362 from last year, a catastrophic vulnerability in Progress MOVEit Transfer that shook the industry, affecting high-profile victims like the BBC and the FBI. Sensitive data was leaked and destroyed as the cl0p ransomware gang exploited zero-day vulnerabilities to steal data, leaving a trail of chaos. Today, a new threat emerges on the horizon: the CVE-2024-5806 vulnerability. The Past: CVE-2023-34362 CVE-2023-34362 (https://nvd.nist.gov/vuln/detail/CVE-2023-34362) represents one of the most critical vulnerabilities that hit Progress MOVEit Transfer, a widely used software for secure file transfer.

KillSec Announces New Ransomware-as-a-Service (RaaS) Platform

June 25, 2024 – KillSec, a well-known hacktivist group, has announced the launch of their latest offering on their Telegram channel: KillSec RaaS (Ransomware-as-a-Service). This new platform promises to enhance the capabilities of aspiring cybercriminals by providing advanced tools and user-friendly features. Post from KillSec’s Telegram Channel Advanced Locker in C++ One of the main features of KillSec RaaS is its advanced locker, written in C++. This programming language is known for its efficiency and performance, making the locker both powerful and fast. The locker is designed to encrypt files on the victim’s machine, rendering them inaccessible without a decryption key, which

UNZIPPED DATA – LEVI STRAUSS COMPROMISED ACCOUNTS

The legendary Jeans retailer Levi Strauss & Co. identified a significant data breach that affected over 72,000 customers. The incident was discovered on June 13th, 2024 and it was the result of a credential stuffing attack, where attackers used combination of e-mails and passwords found from third parties sources to gain unauthorized access to victim accounts. The compromised data included names, order history, emails and addresses, exposing potential additional security risks. The breach involved exactly 72.231 unique costumers. Currently, there’s no evidence of the attackers’ presence on the Dark Web. The company’s statement is the only confirmation of the credential stuffing attack.

lockbit

LockBit: The Bluff of Double Extortion Against the Federal Reserve

In recent years, the cybersecurity landscape has been dominated by the growing threat posed by ransomware groups. Among these, LockBit has emerged as one of the most notorious and feared. However, a recent event has called their credibility into question: the announcement of a supposed double extortion against the Federal Reserve, which turned out to be a bluff. The Context: Who is LockBit? LockBit is a cybercriminal group known for using ransomware as their main weapon. Active since 2019, this group specializes in targeted attacks against large companies and institutions. Their attack strategy is often based on the technique of “double extortion,”

Linux Kernel UAF 0-day Vulnerability on sale in the Dark Web 

Recently, a security alert shaked the infosec environment: A malicious actor has announced the sale of Use After Free (UAF) 0-day vulnerability affecting the Linux Kernel on the well-known darknet forum BreachForum. The vulnerabilit permits high privileges code execution to low priviliged users, posing a serious threat to affected systems. Vulnerability Details The vulnerability author specifies that the vulnerability affects the 6.6.15-amd64 version of the Linux Kernel. UAF occurs when the memory freed previously could be subsequently re-used allowing attackers to execute arbitrary code with High Privileges (Local Privilege Escalation), bypassing OS’s standard secuirty measures Payment Methods In the post the exploit author