Red Hot Cyber, il blog italiano sulla sicurezza informatica
Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Select language
Italian Spanish
Search
Enterprise BusinessLog 320x200 1
Fortinet 970x120px

Tag: ransomware

Cambridge University Press & Assessment Ends Up in the DLS of INC Ransomware

Pietro Melillo 29/06/2024

In a recent cyberattack, the cybercriminal group known as “INC Ransomware” declared that they had breached the systems of Cambridge University Press & Assessment, employing a double extortion strategy. This tactic, increasingly common among ransomware groups, involves the theft and encryption of the victim’s data, followed by the threat of publicly disclosing the data if a ransom is not paid. The Attack on Cambridge University Press & Assessment On June 24, 2024, the INC Ransomware group published information related to the attack on their disclosure blog, including stolen documents as proof of the intrusion. Cambridge University Press & Assessment, one of the

Threat Actor “DragonForce” Seeks New Partners 

RHC Dark Lab 27/06/2024

A recent post on a dark web forum reveals that a cybercriminal group known as “DragonForce” is actively seeking new partners to join their Ransomware-as-a-Service (RaaS) operation. This recruitment drive is aimed at expanding their capabilities by incorporating specialists from various fields, particularly access specialists and pentesters, or teams of pentesters. Recruitment Details According to the post, DragonForce is offering an attractive partnership deal to entice skilled individuals and teams: Operational Capabilities The post highlights several key features of DragonForce’s operation that are designed to support their partners: Organizational Structure DragonForce operates with a defined organizational structure, maintaining a hierarchical system to

Cyber ​​catastrophe in sight? The new Bug on MOVEit has an Online PoC Exploit

RHC Dark Lab 27/06/2024

In the realm of cybersecurity, vulnerabilities constantly represent a significant risk for businesses and institutions. Many system administrators may recall CVE-2023-34362 from last year, a catastrophic vulnerability in Progress MOVEit Transfer that shook the industry, affecting high-profile victims like the BBC and the FBI. Sensitive data was leaked and destroyed as the cl0p ransomware gang exploited zero-day vulnerabilities to steal data, leaving a trail of chaos. Today, a new threat emerges on the horizon: the CVE-2024-5806 vulnerability. The Past: CVE-2023-34362 CVE-2023-34362 (https://nvd.nist.gov/vuln/detail/CVE-2023-34362) represents one of the most critical vulnerabilities that hit Progress MOVEit Transfer, a widely used software for secure file transfer.

KillSec Announces New Ransomware-as-a-Service (RaaS) Platform

RHC Dark Lab 26/06/2024

June 25, 2024 – KillSec, a well-known hacktivist group, has announced the launch of their latest offering on their Telegram channel: KillSec RaaS (Ransomware-as-a-Service). This new platform promises to enhance the capabilities of aspiring cybercriminals by providing advanced tools and user-friendly features. Post from KillSec’s Telegram Channel Advanced Locker in C++ One of the main features of KillSec RaaS is its advanced locker, written in C++. This programming language is known for its efficiency and performance, making the locker both powerful and fast. The locker is designed to encrypt files on the victim’s machine, rendering them inaccessible without a decryption key, which

lockbit

LockBit: The Bluff of Double Extortion Against the Federal Reserve

RHC Dark Lab 26/06/2024

In recent years, the cybersecurity landscape has been dominated by the growing threat posed by ransomware groups. Among these, LockBit has emerged as one of the most notorious and feared. However, a recent event has called their credibility into question: the announcement of a supposed double extortion against the Federal Reserve, which turned out to be a bluff. The Context: Who is LockBit? LockBit is a cybercriminal group known for using ransomware as their main weapon. Active since 2019, this group specializes in targeted attacks against large companies and institutions. Their attack strategy is often based on the technique of “double extortion,”

Category