Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
Banner Ancharia Mobile 1
Banner Desktop

Tag: dark web

Fox Kitten and Br0k3r: The Iranian Cyber Contractor Collaborating with Ransomware Gangs

We continue our series of articles on IABs by writing about an Iranian cyber contractor that not only works as an initial access broker but also provides support to ransomware gangs to fill their and their own pockets with money. In a CISA report published in August 2024, CISA, the FBI and the DoD Cyber Crimes Division say that an Iranian group known as “Pioneer Kitten”, “Fox Kitten”, “UNC757”, “Parisite”, “RUBIDIUM” or “Lemon Sandstorm” has been successful in cyber crime by selling access to hackable corporate networks. The group has also operated under other names such as “Br0k3r” and “xplfinder” and has

REvil: Sentenced but then set free. The most controversial court case ever

Do you remember the infamous REvil cyber gang? The Russian hacker group responsible for some of the most devastating ransomware attacks in the early days of this global threat, known for posting their criminal exploits on the popular underground forum “Happy Blog”. The Dzerzhinsky Court in St. Petersburg has convicted four more participants in the REvil (aka Sodinokibi) hacking group case, according to media reports. All those convicted were given actual prison sentences, but the defendants were released, having already served their full sentences in pre-trial detention, during the investigation and trial. REvil’s activities ceased in January 2022, after the FSB announced the

Shock in France: the gentlemen of BreachForums were twenty-year-old French citizens!

Shocking news in France: one of the largest global cybercrime networks dismantled. The BreachForum hackers were… French. French authorities have busted a large cybercrime operation, arresting five young French hackers responsible for running BreachForum, one of the world’s most active underground digital marketplaces for buying and selling stolen data. The operation was conducted with synchronized raids across France. At first, it was believed that Russian groups or groups operating in Russian-speaking territories were behind BreachForum. But investigations by the Brigade de la Crime Intérieur (BL2C) of the Paris police headquarters have turned the tables: four of the main managers of the forum

US-Iran Cyberwar: DHS Raises Alarm, American Networks Under Attack

The United States has warned of possible cyber attacks by pro-Iranian groups following a series of airstrikes against Iranian nuclear facilities, as part of the armed conflict between Iran and Israel that began on June 13, 2025. The US Department of Homeland Security (DHS) said that the current situation creates a “elevated threat” in the country’s cyberspace. The department said that hacktivists, as well as groups associated with Iranian government agencies, will most likely focus their attacks on American networks and vulnerable devices connected to the Internet. According to the DHS, such activities have already been recorded: these are low-level attacks aimed at creating

$200 for Access to an Italian Company! While the Dark Web is doing business, are you ready to defend yourself?

Following the case of the 568 endpoints of an Italian industrial machinery company, another compromised access related to an Italian software engineering company has ended up for sale on an underground forum frequented by Initial Access Brokers and ransomware actors. The listing, posted by the user spartanking, offers full access to a server with local administrator privileges and remote control via AnyDesk. The ad clearly states that the compromised system is joined to an Active Directory domain. As stated in the post: The access would therefore allow elevated privileges on at least one server. In a screenshot, the compromised system is noted to be aMicrosoft Windows Server 2012 R2 Standard installed

Cloudflare Mitigates 7.3 Terabits Per Second Attack. Imagine 9350 HD Movies Downloaded in 45 Seconds

In mid-May 2025, Cloudflare blocked the largest DDoS attack ever recorded: 7.3 terabits per second (Tbps). This event comes shortly after the release of the DDoS Threat Report for Q1 2025 on April 27, 2025, which highlighted attacks reaching 6.5 Tbps and 4.8 billion packets per second (pps). 37.4 terabytes isn’t a huge number by today’s standards, but downloading 37.4 terabytes in just 45 seconds is. That’s the equivalent of flooding the internet with over 9,350 HD movies or streaming 7,480 hours of uninterrupted high-definition video (nearly a year’s worth of back-to-back TV binge-watching) in just 45 seconds. If it were music,

Your VPN is a Trojan! Here are 17 Free Apps Made in China That Spy on You While Google and Apple Get Fat

“If you don’t pay for the service, you are the product. This is true for social networks, but also for free VPNs: your data, your privacy, is often the real price to pay. Researchers at the Tech Transparency Projecthave reported that at least 17 free VPN apps with alleged ties to China are still available in the US versions of the Apple and Google stores, and big tech companies are managing to make money from these apps despite the risks to user privacy. The first investigation by TTP surfaced in April, revealing that the data of millions of users from more than two

RHC GhostSec interview: hacktivism in the shadows of terrorism and cyber conflict

Ghost Security, also known as GhostSec, is a hacktivist group which emerged in the context of the cyber war against Islamic extremism. The first actions of the group date back to the aftermath of the attack on the Charlie Hebdo newsroom, January 2015. It is considered an offshoot of the Anonymous collective, from which it later partially broke away. GhostSec became known for its digital offensives against websites, social accounts and online infrastructure used by ISIS to spread propaganda and coordinate terrorist activities. The group claimed to have shut down hundreds of ISIS-affiliated accounts and helped thwart potential terrorist attacks by actively

Group-IB contributes to INTERPOL’s Operation Secure, leading to the arrest of 32 suspects linked to information stealer malware in Asia

[Singapore; 11 June, 2025] Group-IB, a leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime, announced today that it has contributed to INTERPOL’s “Operation Secure”, which took down the infrastructure linked to information stealers (infostealers) in Asia that claimed more than 216,000 potential victims. The operation, which was conducted from January to April 2025, resulted in the arrest of 32 suspects, taking down more than 20,000 malicious IP addresses and domains, and the seizure of 41 servers containing over 100GB of data that were linked to the cybercriminal activities. During the course of Operation Secure, Group-IB’s Threat Intelligence team

RHC Interviews NOVA Ransomware – “Expect Dangerous Attacks. No One Is Safe.” | BLACKVIEW Series

On May 10, 2025, the City of Pisa suffered a ransomware attack within their computer systems. The next day Nova claimed the attack and on the 21st of the same month threatened to publish 2TB of data stolen from the municipality’s servers. Nova RaaS appeared the first time in the April 2025 period making itself known for its direct and humiliating public communications to victims. From their DLS there does not appear to be a particular focus on specific sectors or states. Nova revamped predecessor RaLord by even going so far as to create a customized chat system for communications with their