cybercrime Archivi - Page 2 of 9

Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.

Tag: cybercrime

Zero-Click Attack on Notepad++. HackerHood Tested the Exploit and It Really Works with Little

Redazione RHC 25/06/2025

A dangerous vulnerability has been discovered in the latest version of the popular text editor Notepad++ that allows an attacker togain complete control over the system. The vulnerability has been identified as CVE-2025-49144 and affects version 8.8.1 of the installer, released on May 5, 2025. The issue is related to the “binary file replacement” technique, where the installer accesses executable files from the current working directory without proper verification. Researchers have discovered that an attacker can install a malicious file, such as a modified regsvr32.exe file, in the same folder where the installer is located. Upon startup, the installer will automatically download the malicious

US-Iran Cyberwar: DHS Raises Alarm, American Networks Under Attack

Redazione RHC 24/06/2025

The United States has warned of possible cyber attacks by pro-Iranian groups following a series of airstrikes against Iranian nuclear facilities, as part of the armed conflict between Iran and Israel that began on June 13, 2025. The US Department of Homeland Security (DHS) said that the current situation creates a “elevated threat” in the country’s cyberspace. The department said that hacktivists, as well as groups associated with Iranian government agencies, will most likely focus their attacks on American networks and vulnerable devices connected to the Internet. According to the DHS, such activities have already been recorded: these are low-level attacks aimed at creating

“Jailbreak as a Service” is Coming: 60 Euros a Month to Purchase Cybercrime-Ready AI Systems

Redazione RHC 24/06/2025

According to a report by Cato Networks, cybercriminals continue to actively use LLM patterns in their attacks. Specifically, we are talking about versions of theGrok and Mixtral patterns that have been deliberately modified to bypass built-in restrictions and generate malicious content. Apparently, one such modified version of Grok appeared on the popular forum BreachForums in February 2025. It was posted by a user with the pseudonym Keanu. The tool is a wrapper around the original Grok model and is controlled via a specially written system prompt. This is how the authors ensure that the model bypasses protection mechanisms and generates phishing emails, malicious code, and hacking instructions. A

$200 for Access to an Italian Company! While the Dark Web is doing business, are you ready to defend yourself?

Redazione RHC 24/06/2025

Following the case of the 568 endpoints of an Italian industrial machinery company, another compromised access related to an Italian software engineering company has ended up for sale on an underground forum frequented by Initial Access Brokers and ransomware actors. The listing, posted by the user spartanking, offers full access to a server with local administrator privileges and remote control via AnyDesk. The ad clearly states that the compromised system is joined to an Active Directory domain. As stated in the post: The access would therefore allow elevated privileges on at least one server. In a screenshot, the compromised system is noted to be aMicrosoft Windows Server 2012 R2 Standard installed

“Cleaning Up” Windows Update! Microsoft Declares War on Drivers Exploited in Ransomware Attacks

Redazione RHC 24/06/2025

Microsoft announced that it will periodically remove outdated drivers from the Windows Update Catalog to reduce risk and improve compatibility. “The goal of this initiative is to provide the best set of drivers on Windows Update for the various hardware solutions in the Windows ecosystem and help keep Microsoft Windows secure,” the company said in a statement. Microsoft also added that “This initiative will periodically clean up drivers on Windows Update, which will result in some drivers not being deployed on systems in our ecosystem.” As the company has clarified, the first phase of the “cleanup” procedure will affect drivers for which Windows Update

Cloudflare Mitigates 7.3 Terabits Per Second Attack. Imagine 9350 HD Movies Downloaded in 45 Seconds

Redazione RHC 23/06/2025

In mid-May 2025, Cloudflare blocked the largest DDoS attack ever recorded: 7.3 terabits per second (Tbps). This event comes shortly after the release of the DDoS Threat Report for Q1 2025 on April 27, 2025, which highlighted attacks reaching 6.5 Tbps and 4.8 billion packets per second (pps). 37.4 terabytes isn’t a huge number by today’s standards, but downloading 37.4 terabytes in just 45 seconds is. That’s the equivalent of flooding the internet with over 9,350 HD movies or streaming 7,480 hours of uninterrupted high-definition video (nearly a year’s worth of back-to-back TV binge-watching) in just 45 seconds. If it were music,

Your VPN is a Trojan! Here are 17 Free Apps Made in China That Spy on You While Google and Apple Get Fat

Redazione RHC 23/06/2025

“If you don’t pay for the service, you are the product. This is true for social networks, but also for free VPNs: your data, your privacy, is often the real price to pay. Researchers at the Tech Transparency Projecthave reported that at least 17 free VPN apps with alleged ties to China are still available in the US versions of the Apple and Google stores, and big tech companies are managing to make money from these apps despite the risks to user privacy. The first investigation by TTP surfaced in April, revealing that the data of millions of users from more than two

FortiGate Under Attack: Tools for Mass Exploitation of Exposed APIs for Sale

Redazione RHC 23/06/2025

A new and alarming development is shaking up the cybersecurity landscape: a malicious actor has advertised on the dark web a highly sophisticated exploit aimed at compromising FortiGate devices. A new exploit priced at $12,000 for FortiGate firewalls has appeared for sale on the popular underground forum Exploit. The post, published by a user with the pseudonym Anon-WMG, presents a tool capable of massively compromising Fortinet devices by exploiting exposed APIs. Technical features of the exploit Called “FortiGate API Dump Exploit (~7.2 and below)”, the tool is capable of interacting with over 170 FortiGate API endpoints, with declared compatibility for versions 6.x

Massive Windows Crash: The OpenVPN Flaw That Can Knock Out Infrastructures

Redazione RHC 22/06/2025

A critical vulnerability has been discovered in the OpenVPN data channel offload driver for Windows, which can be exploited by local attackers to crash systems. The bug, classified as CVE-2025-50054, is a buffer overflow that affects 1.3.0 and earlier versions of the ovpn-dco-win driver, as well as OpenVPN versions up to 2.5.8, where that driver was used as the default virtual network adapter. “When using ovpn-dco-win, the OpenVPN software does not send data traffic back and forth between user and kernel space for encryption, decryption, and routing, but payload operations occur in the Windows kernel,” according to documentation released by OpenVPN . According to

RHC GhostSec interview: hacktivism in the shadows of terrorism and cyber conflict

RHC Dark Lab 12/06/2025

Ghost Security, also known as GhostSec, is a hacktivist group which emerged in the context of the cyber war against Islamic extremism. The first actions of the group date back to the aftermath of the attack on the Charlie Hebdo newsroom, January 2015. It is considered an offshoot of the Anonymous collective, from which it later partially broke away. GhostSec became known for its digital offensives against websites, social accounts and online infrastructure used by ISIS to spread propaganda and coordinate terrorist activities. The group claimed to have shut down hundreds of ISIS-affiliated accounts and helped thwart potential terrorist attacks by actively

Tag: cybercrime

Category