Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
TM RedHotCyber 320x100 042514
Fortinet 970x120px

Category: Cybercrime and Darknet

Drones at Brussels Airport and Military Bases: Security at Risk

On Tuesday evening, due to the presence of a drone in the airspace, air traffic controller Skeyes ordered the temporary suspension of flights departing and arriving at Brussels Airport from 8:00 PM to 9:30 PM. Subsequently, around 10:00 PM, the first reports were received that the airspace had been closed again. Several planes have been diverted to other airports, such as Maastricht and even Schiphol Airport (Amsterdam). This is the first time that air traffic at Brussels Airport has been disrupted by a drone, but similar incidents have occurred elsewhere in Europe. Indeed, drones forced Copenhagen, Oslo, and Aalborg airports to temporarily

Does Microsoft use macOS to create Windows wallpapers? Probably!

On October 29, Microsoft released a wallpaper to commemorate the eleventh anniversary of the Windows Insider program, and it is speculated that it was created using macOS. Let us remember that Windows Insider is an official program launched by Microsoft in 2014 that allows users to preview new versions of Windows before their public release . Subscribers — called “Insiders” — receive experimental updates, in-development features, and pre-release builds of the operating system, contributing feedback and bug reports to improve the software . The program is open to all users with a Microsoft account and is divided into different channels (Canary, Dev,

Louvre Theft: Windows 2000 and Windows XP on Networks, as Well as Simple Passwords

As we know, the thieves in the “theft of the century” entered through a second-floor window of the Louvre Museum, but the museum had other problems besides unprotected windows. Although Culture Minister Rachida Dati stated that “the museum’s security systems did not fail,” there are indications that some cybersecurity breaches did occur . According to confidential documents seen by the newspaper Libération, in 2014, simply typing ” LOUVRE ” accessed the server responsible for video surveillance at France’s most famous museum. Or typing ” THALES ” accessed the software published by the company of the same name. These passwords, which in technical

SesameOp: The Malware That Uses OpenAI Assistants for Command and Control

Microsoft has discovered a new malware, dubbed SesameOp , and published details of how it works . This backdoor was unusual: its creators used the OpenAI Assistants API as a covert control channel , allowing them to mask activity within the infected system and evade traditional detection tools. The attack was discovered in July 2025 during the investigation of a complex attack, during which an unknown group remained present on the victim’s infrastructure for several months. The identity of the targeted organization has not been disclosed, but the investigation revealed the presence of a large network of internal web shells and malicious

Chinese hackers target European diplomatic agencies (including Italy)

The China-linked hacker group UNC6384 ( also known as Mustang Panda ) is conducting a large-scale cyberespionage campaign targeting European diplomatic and government agencies. According to Arctic Wolf and StrikeReady , hackers are exploiting an unpatched Windows vulnerability related to LNK shortcuts. The attacks were recorded in Hungary, Belgium, Italy, the Netherlands, and Serbia between September and October 2025. According to researchers, the attacks begin with targeted phishing emails containing URLs to malicious LNK files. The subject lines of these emails typically refer to NATO defense procurement workshops, European Commission meetings on border facilitation, and other multilateral diplomatic events. The malicious files

Eight 0-days worth $35 million sold to Russia by US insiders

Former US defense contractor CEO Peter Williams has pleaded guilty to selling ” eight sensitive, protected cyber exploits” to Russian zero-day broker Operation Zero. Court documents and a TechCrunch investigation have revealed how the head of a company that developed exploits and tools for Western government cyber operations secretly exported and resold its in-house developments for three years. According to investigators, a 39-year-old Australian citizen, known to colleagues as ” Doogie ,” stole eight zero-day vulnerabilities that could be used to hack modern devices and operating systems. The expensive tools were intended exclusively for U.S. government agencies and their allies. Williams estimated

Trump refuses to export Nvidia chips. China responds: “Don’t worry, we’ll do it ourselves.”

Reuters reported that Trump told reporters during a pre-recorded interview on CBS’s “60 Minutes” and on Air Force One during the return flight: “We’re not going to let any country have the most advanced chips except the United States.” Trump added: “We’re not going to sell Blackwell chips to anyone else.” These remarks suggest that the Trump administration may plan to impose tighter export restrictions on cutting-edge U.S. artificial intelligence chips than in the past, potentially cutting off China and other countries from access to these high-performance semiconductors. Furthermore, the Wall Street Journal, citing U.S. officials, reported that during his meeting with

Goodbye, malware! In 2025, criminal hackers will use legitimate accounts to remain invisible.

A FortiGuard report for the first half of 2025 shows that financially motivated attackers are increasingly eschewing sophisticated exploits and malware. Instead , they are using valid accounts and legitimate remote access tools to penetrate corporate networks undetected. This approach has proven not only simpler and cheaper, but also significantly more effective: attacks using stolen passwords are increasingly escaping detection. Experts report that in the first six months of the year , they investigated dozens of incidents across various sectors, from manufacturing to finance and telecommunications . Analysis of these cases revealed a recurring pattern: attackers gain access using stolen or purchased

Cyberstalking Against Women: Analysis and Legal Implications

This is the third in a series of articles analyzing gender-based violence in the digital context, in anticipation of November 25th, the International Day for the Elimination of Violence against Women. The focus here is on cyberstalking and its legal and social implications. Cyberstalking represents one of the most subtle threats of the digital age. It’s not just a rehash of traditional stalking, but a behavior that exploits and amplifies the weaknesses of the virtual world. It’s a repetitive persecution carried out via electronic means, which profoundly undermines people’s privacy and individual freedom. The criminological analysis I offer in university classrooms and

WSUS security update has broken hotpatches on Windows Server 2025

A breakthrough patch fixed a security flaw in the Windows Server Update Service (WSUS), but apparently caused hotpatching to stop working on certain Windows Server 2025 servers. Microsoft Hotpatch is a technology developed by Microsoft that allows you to apply security updates to Windows machines without requiring a system reboot . It was initially introduced for Windows Server Azure Edition , but Microsoft is gradually extending it to other versions of Windows, including desktop versions (in an experimental phase). The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to secure their systems after including this vulnerability in its KEV