Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
Banner Mobile
970x120

Search Results for: revil

REvil: Sentenced but then set free. The most controversial court case ever

Do you remember the infamous REvil cyber gang? The Russian hacker group responsible for some of the most devastating ransomware attacks in the early days of this global threat, known for posting their criminal exploits on the popular underground forum “Happy Blog”. The Dzerzhinsky Court in St. Petersburg has convicted four more participants in the REvil (aka Sodinokibi) hacking group case, according to media reports. All those convicted were given actual prison sentences, but the defendants were released, having already served their full sentences in pre-trial detention, during the investigation and trial. REvil’s activities ceased in January 2022, after the FSB announced the

Discovering DarkSide: Techniques, Tactics, and Affiliations

Researchers across the cyber community have been exchanging a great deal of information lately about the DarkSide ransomware cyber gang, the emerging cybercriminal group that has suddenly risen to global infamy. We had also talked about Sodinokibi/REvil in a previous article , another cyber-gang known to date for high-profile attacks on companies such as Honda, Jack Daniels, Acer, Grubman Shire Meiselas & Sacks and lastly on Quanta/Apple, also publishing an interview with one of its leaders called UNKNOW, a few weeks ago. But after the Colonial Pipeline incident by DarkSide, how could we not talk about this emerging cyber gang? Having first

A manifesto after 72 hours! Will cybercriminals really retreat?

Fifteen of the most notorious cybercriminal groups, including Scattered Spider, ShinyHunters, and Lapsus$, have announced their closure. Their collective statement, published on BreachForums, is the most explicit message from the underground in recent years. The group emphasized that their goal was less extortion than to demonstrate the weaknesses of digital systems. Now, however, they have declared that they prefer “silence” to public attacks. The document, published under several pseudonyms of well-known hackers, claims that the decision was made after three days of silence, spent by the participants with their families and reviewing their plans in the event of persecution. They said they

After XSS’s shutdown, Rehubcom arrives. The Dark Web continues.

A former moderator of the XSS dark web forum, known as Rehub, has launched his own platform called Rehubcom. The move coincides with the arrest of XSS’s administrator in Kiev and the closure of the forum’s domain, as well as the exit of DamageLib, paving the way for new competitors to emerge on the dark web. Rehubcom could be one such replacement, quickly filling the void left by XSS itself. XSS, originally called DaMaGeLaB, was a forum that appeared on the dark web and was one of the oldest and most influential forums in the cybercrime world. Exploits, malware, access to corporate

The Monte Carlo Casino is on D4rk4rmy’s website! The ransomware group claims responsibility for the cyber attack.

The criminal organization known as D4rk4rmy has claimed responsibility for the cyber attack against the Monte-Carlo Société des Bains de Mer (SBM) on its Data Leak Site (DLS). The site contains a post stating that an update will be available in 12 days. Founded in 1863, SBM is the leading operator in the luxury hotel sector in the Principality of Monaco. Among the most renowned properties managed by the company are the Hôtel de Paris and the Monte Carlo Casino, which play a key role in shaping the Principality’s international image of refinement and prestige. Attackers report the theft of sensitive customer

What is malware? Between science fiction, the lab, and reality.

We often talk about “Malware”. But even today, many people don’t fully understand the real meaning of this word. With this article, we want to explain precisely what malware is, the main types and their differences, so as to no longer confuse them and to understand them more precisely. The word malware comes from the English language, from the union of two words: MALicious and softWARE, which means “malicious software”, or code capable of causing damage, or guaranteeing an advantage to its creator. But to fully understand the evolution of “malware”; We need to go back in time, when in 1949, the

What are supply chain attacks? A more concrete threat than ever.

As businesses become increasingly dependent on technology, connectivity, and third parties in general, supply chain attacks are becoming increasingly common. These attacks are aimed at compromising companies through their suppliers and business partners. Supply chain attacks can pose a significant threat to businesses and organizations, as they can compromise their security and that of the products and services they provide to customers. In this article, we’ll explore the phenomenon of supply chain attacks: what they are, how a supply chain attack occurs, the most common attacks, and how organizations can take measures to protect themselves from these threats and how to choose

What is ransomware? Let’s explore how RaaS works and what it means.

Many people often want to understand the ransomware phenomenon precisely, its meaning, the methods of violation, and the crime that revolves around it, struggling to find information scattered across thousands of articles. This article aims to answer all these questions, providing a comprehensive, yet simple, guide to understanding this phenomenon as a whole. On the pages of every newspaper, we hear about huge cyber breaches, million-dollar ransoms, cyber gangs, RaaS, and cyber warfare. These are all words that can be very confusing for people who aren’t specialized in cyber security. With this article we want to explain what ransomware is, how the

Crazyhunter: The Ransomware with the Three-Dimensional Data Annihilation System That Redefines Data Destruction

In the reconnaissance of the world of the underground and criminal groups carried out by Red Hot Cyber’s DarkLab threat intelligence lab, we came across a Data Leak Site of a cyber gang that had never been monitored before: Crazyhunter. With a distinct identity and a manifesto that sets it apart from other cybercriminal actors, Crazyhunter presents itself as a sophisticated operation that focuses on attack speed, data destruction, and a highly structured criminal branding system. From the information gathered on their Data Leak Site (DLS), accessible through the Tor network, the group appears to adopt a methodical and aggressive approach, aimed

The Story Of Conti Ransomware – The War Within (Episode 2)

This is a continuation of the Conti story. You can read the previous part, which covered the group’s origins, in the previous article. We will now explore the internal components of the group and how their own ecosystem began to collapse. Wizard Spider is still full of surprises and in this episode we will unravel the most proibhited ones The Fool – Trick or Treat Mid-2021, Conti is dominating the headlines with consistent attacks and gaining ransoms from victims. The RaaS operation has been a big deal in the ecosystem, attracting the attention of everyone involved, including victims, affiliates, and law enforcement