Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
LECS 320x100 1
UtiliaCS 970x120

Tag: cyber threat intelligence

Alleged SpaceX Database Breach Published on BreachForums

Pietro Melillo 21/09/2024

A recent post on a dark web forum has caught the attention of the international cybersecurity community. A user, identified by the nickname l33tfg, claimed to have published a supposed data leak from SpaceX, the aerospace company owned by Elon Musk. According to the post, the breach allegedly contains sensitive data including emails, password hashes, phone numbers, hosts, and IP addresses. While the news has not yet been officially confirmed by SpaceX or other verified sources, the incident could pose a serious threat to the organization and the security of its corporate data. Attack Overview: Attacker Profile and Motivations The post, dated

WhiteHouse.gov Data Breach: Threat Actors Leak Sensitive Information!

Redazione RHC 21/09/2024

Recently, a threat actor on a dark web forum has posted a claim regarding an alleged data breach involving WhiteHouse.gov. The post, made by a user named “l33tfg,” asserts that sensitive information from the White House’s official website has been leaked. According to the post, the data includes emails, names, phone numbers, hashes, and IP addresses. At the moment, we cannot confirm the veracity of this claim, as the organization has yet to release any official statement on its website regarding the incident. Therefore, this article should be considered as a source of intelligence. Details of the Alleged Breach In the forum

RHC interviews Qilin Ransomware! “Let’s play fair and wait for a worthy opponent on the field”

RHC Dark Lab 19/09/2024

Qilin (from Chinese :麒麟) is a legendary creature that appears in Chinese mythology and is said to appear with the imminent arrival or demise of a sage or illustrious ruler. The Qilin ransomware is a prime example of the growing complexity of cyber threats. Discovered in 2022, Qilin immediately attracted attention for its ability to target critical sectors such as healthcare and education, particularly in the regions of Africa and Asia. Written in Rust and C, Qilin offers an unprecedented level of customisation that sets it apart from most other ransomware. The operators behind this threat can change the extension of encrypted

A Threat Actors Posts Update on Luxottica’s 2021 Data Breach

Redazione RHC 25/07/2024

Recently, a threat actor in a clandestine forum posted an update on the 2021 data breach concerning the giant Luxottica, one of the world’s largest eyewear companies. According to the post, the breach allegedly exposed extensive personal information of millions of individuals. This article explores the details of the alleged breach based on information provided by the threat actor. At this time, we cannot confirm the veracity of the news, as the organization has not yet issued any official press release on its website regarding the incident. Therefore, this article should be considered an ‘intelligence source.’ Details of the Alleged Breach According

RHC interviews RADAR and DISPOSSESSOR: “When it comes to security, the best defense is a good offense.”

RHC Dark Lab 25/07/2024

In our usual underground analysis activities, we came into contact with the cyber gang DISPOSSESSOR, which came to attention in February 2024 in the cyber threat landscape. Accessing their Data Leak Site (DLS) one immediately realizes a strong resemblance to that of the well-known cyber-gang LockBit, and even the number of views of individual posts, taking into account that it is a blog in the onion network, has nothing to envy the elite cyber-gang. This profound similarity suggests a possible reorganization by affiliates of the world’s longest-running cybergang, LockBit, in part because of the two Cronos operations, which saw law enforcement break

Exposed the Data of 3,379 Spanish Doctors! When Fraud Becomes “On-Target”

Redazione RHC 24/07/2024

Recently, a threat actor in an underground forum called Breach Forums published an alleged data breach. The post claims to have exposed the names, departments, and emails of 3,379 Spanish doctors. This information was shared by a user going by the name “jewwu.” At the moment, we cannot confirm the veracity of the news, as we have not had access to the actual data set. Therefore, this article should be considered as ‘intelligence source.’ Details of the Alleged Breach According to the forum post, the breached data includes names, departments, emails, and other personal details of the doctors. The post included a

Sale of a 0Day RCE Exploit for GLPI HelpDesk

Pietro Melillo 18/07/2024

Recently, a user on the Breachforums known as “cisc0” posted an announcement regarding the sale of a 0Day exploit for GLPI HelpDesk. According to the user, this exploit works on all versions of the software without exception. The news has raised concerns among cybersecurity professionals and organizations that use this IT service management system. Description of the Exploit The user “cisc0” claims that the exploit allows remote code execution (RCE) on all versions of GLPI HelpDesk. This type of vulnerability is particularly dangerous as it enables attackers to execute arbitrary commands on the vulnerable server, potentially gaining full control of the system.

Play Ransomware Claims Attack on MIPS Technologies

Pietro Melillo 18/07/2024

In the last few hours, the Data Leak site of the ransomware gang Play Ransomware has published a new claim: the giant MIPS Technologies (www.mips.com) has been the victim of an attack. Although the official publication is scheduled for July 19, 2024, the site has already made some details public, raising concerns among the company’s partners and customers. Play Ransomware Play Ransomware is one of the many ransomware gangs that have emerged in recent years. These criminal groups operate by encrypting victims’ data and demanding a ransom for restoration. Play Ransomware is distinguished by its strategy of publishing stolen data on Data

Data Breach: Personal Information of 6K NATO Employees for Sale

Pietro Melillo 18/07/2024

On July 17, 2024, user Vadimblyaa posted on a well-known cybercriminal forum, claiming to possess personal information of 6,000 NATO employees, acquired through a data breach that occurred on July 13, 2024. Vadimblyaa has put this information up for sale and invites interested parties to make offers for its purchase. Breach Details Vadimblyaa provided specific details regarding the format and content of the compromised data, which includes: According to the report, the file contains over 6,000 lines of data. Veracity and Implications At this time, we cannot precisely confirm the authenticity of the breach, as the NATO organization has not yet released

Rockstar Games Possibly Victim of a Massive Data Leak!

Pietro Melillo 16/07/2024

Recently, an alleged data leak has involved Rockstar Games, one of the world’s largest video game producers, famous for titles like Grand Theft Auto and Red Dead Redemption. According to a user on a hacking forum, personal data of Rockstar Games staff members have been compromised. This article provides a detailed analysis of the available information and the implications of this breach. Data Leak Details Source and Content of the Leak The leak was reported by a user with the nickname “IsIsakaisIs” on BreachForums, a well-known hacking forum. The user claimed to have obtained 1001 lines of data belonging to Rockstar Games

Category