dark web Archivi - Page 3 of 5

Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.

Tag: dark web

Possible breach at Ukraine’s Ministry of Foreign Affairs: the Qilin Ransomware group claims responsibility for the attack

Pietro Melillo 07/03/2025

The Qilin Ransomware group claims to have compromised the systems of Ukraine’s Ministry of Foreign Affairs, stealing private correspondence, personal information, and official decrees. According to the attackers, some of this data has already been sold to third parties. At the moment, it is not possible to confirm the veracity of these statements because the organization has not yet released any official press statement on its website regarding the incident. Consequently, the information presented in this article should be treated solely as an intelligence source. Details of the Alleged Breach Status of the Investigation Conclusions At present, the alleged breach claimed by

Analysis of Recorded Future’s CVE Report – February 2025

Sandro Sana 05/03/2025

The monthly Recorded Future CVE report for February 2025 provides a detailed overview of current cybersecurity threats, highlighting a slight decline compared to the previous month. A total of 25 high-impact vulnerabilities were identified, down from 33 in January, yet the overall risk level remains high. Several of these vulnerabilities are already being actively exploited by cybercriminals, making a timely response from corporate security teams essential. One of the key aspects of this report is the ability to analyze the issue from two complementary perspectives: that of CEOs and that of IT managers and CISOs. On one hand, business leaders must understand

Ransomware Gangs weaponize Windows Defender Application Control (WDAC) to disable EDR products.

Alex Necula 13/01/2025

In the past days we saw that Ransomware Gangs use WDAC to disable EDR products. I have known this type of attack for a year when a guy posts a similar technique on Twitter, but this is the first time that was used in Ransomware Attacks. So, it’s time to explain how it works and how to check it. First, the WDAC is a feature of Microsoft that is very similar to App Locker. We need to download Application Control Wizard from Microsoft webpage. After we install it, we can open it and define the policy. Here we can do two things,

The Exploit for the RCE on Palo Alto Firewalls is now Online! And let the Administration be for all

Luca Stivali 03/12/2024

A few hours ago on Breach Forum, a threat actor by the name “newplzqibeme” shared a GitHub repository where a python-written exploit for active exploitation of CVE-2024-0012 on PanOS (the Palo Alto firewall operating system) is published. The exploit grants the attacker, full administrative access to the firewall with an Authentication Bypass mechanism, gaining administrator access. The post by “newplzqibeme” shows two public IPs as examples, which are most likely exposed and vulnerable firewalls. Firewalls running PanOS 10.2, 11.0, 11.1 and 11.2 are affected by this CVE if not upgraded to the respective versions (>= 10.2.12-h2, >= 11.0.6-h1, >= 11.1.5-h1 and >=

RHC DarkLab Interviews Interlock Ransomware. “Don’t waste your energy and time. We will do it for you.”

RHC Dark Lab 02/12/2024

RHC DarkLab has always taken a unique and provocative approach in the fight against cyber threats, summed up by the motto: ‘One must know the Demons to learn how to counter them.’ This philosophy guides our ongoing commitment to understanding Threat Actors through face-to-face interviews to expose their techniques, tactics and procedures (TTPs) and improve the defences of those facing these insidious adversaries. Cyber gangs, such as Interlock, often present themselves with a mix of highly sophisticated motivations and skills, as demonstrated by recent attacks targeting seemingly secure systems such as FreeBSD. In many cases, they claim to act to fill gaps

RHC DarkLab Interview Stormous Ransomware. Between history, ideology, techniques and tactics

Redazione RHC 24/11/2024

The Stormous group represents a significant threat in the ransomware landscape: it has an established reputation for its targeted attacks and its overtly pro-Russian ideology. The group may have started operating in mid-2021, later becoming known for its aggressive presence on Telegram, its geopolitical motivations and its philosophy of attacking organisations perceived to be hostile to Russia, to which it declared its support, subsequently targeting the organisations of countries considered to be enemies, destabilising their organisations These include the United States, Western countries, India and Ukraine from 2022. However, their attacks in this way not only compromise the victims’ systems, but also

How Threat Actor make EDR’s harmless with a reboot

Alex Necula 22/11/2024

I became aware of this technique like 9 months ago, and now I see this on a attack in the wild conducted by Qilin Ransomware Gang, so it’s time to make it public. One of the most important security things in EDR’s is the possibility to intercept calls to the kernel. For this purpose, EDR’s vendors use MiniFilter Drivers that load on boot. But what happens when these drivers are forced disabled by attacker? The attacker can peacefully make kernel calls without being intercepted by EDR’s. When the Windows load a MiniFilter Driver , there is a order to load them ,

The Story Of Conti Ransomware – The War Within (Episode 2)

Alessio Stefan 22/11/2024

This is a continuation of the Conti story. You can read the previous part, which covered the group’s origins, in the previous article. We will now explore the internal components of the group and how their own ecosystem began to collapse. Wizard Spider is still full of surprises and in this episode we will unravel the most proibhited ones The Fool – Trick or Treat Mid-2021, Conti is dominating the headlines with consistent attacks and gaining ransoms from victims. The RaaS operation has been a big deal in the ecosystem, attracting the attention of everyone involved, including victims, affiliates, and law enforcement

IntelBroker Claims Tesla Charging Database Breach

Redazione RHC 20/11/2024

Recently, the threat actor known as IntelBroker , posted an alleged data breach. The post, which appeared on the BreachForums platform, claims that Tesla’s charging station database has been compromised and made available for download. At this time we cannot confirm the veracity of the news, as the organization has not yet released any official press release on its website regarding the incident. Therefore, this article should be considered as an “intelligence source”. Introduction on the violation The post, published on BreachForums, revealed that the Tesla charging station database has been made available for download. According to the announcement, the database contains approximately 116,000 records

IBM Hacked? Threat Actor ‘888’ Reveals Thousands of Employees’ Data Leak!

Luca Galuppi 31/10/2024

Recently, the notorious Threat Actor, identified by the nickname 888 , claimed to have breached IBM systems and stolen personal data belonging to the company’s employees. The leak, dated October 2024, allegedly resulted in the compromise of approximately 17,500 rows of data. At this time, we cannot confirm the veracity of the news, as the organization has not yet released any official press release on its website regarding the incident. Therefore, this article should be considered as ‘intelligence source’. Details of the Breach According to 888, the breach resulted in the data of approximately 17,500 individuals being compromised. The exfiltrated information is said to contain: names, mobile phone numbers, and international area

Tag: dark web

Category