Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 02-Oct-2025 18:40:36 JST Kevin Beaumont

   Crimson Collective are trying to extort Redhat

   They've stolen about 500gb of data related to corporate customers. File list:

   https://archive.ph/0MwqJ

   #threatintel

   • Embed this notice
     Greem (Graeme. Not Graham!) (greem@cyberplace.social)'s status on Thursday, 02-Oct-2025 18:48:56 JST Greem (Graeme. Not Graham!)

     in reply to

     @GossiTheDog This has Big Oof written all over it.

     It could get very messy very quickly.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Oct-2025 02:06:33 JST Kevin Beaumont

     in reply to

     • BrianKrebs
     • :mastodon: decio

     @briankrebs @decio also posts by “antonio howell”, name of a British actor. Crimson Collective’s first victim is Claro - a telco which was one of the first victims of.. drumroll.. LAPSUS$

   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Friday, 03-Oct-2025 02:06:34 JST BrianKrebs

     in reply to

     • :mastodon: decio

     @decio @GossiTheDog I haven't seen anyone else mention this, but the posts from the Crimson Collective were signed "Miku", which is a nickname used by Thalha Jubair, the 19 y/o in the UK I wrote about last week who was charged in a ton of Scattered Spider ransom activity https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/

   • Embed this notice
     :mastodon: decio (decio@infosec.exchange)'s status on Friday, 03-Oct-2025 02:06:35 JST :mastodon: decio

     in reply to

     @GossiTheDog 👍 thx

     the 2nd proof link https://archive.ph/WqCdu

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Oct-2025 06:56:40 JST Kevin Beaumont

     in reply to

     It’s not 570gb that was stolen btw, there’s group said they were still compressing at that point - they claim it was about half way. Also, it’s compressed so uncompressed.. it’s a lot more either way.

   • Embed this notice
     apth (apth@infosec.exchange)'s status on Friday, 03-Oct-2025 07:24:32 JST apth

     in reply to

     @GossiTheDog thank you VERY much for continuing to post this stuff. Definitely making my life better. If there's a way I can support you, let me know

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Oct-2025 19:41:35 JST Kevin Beaumont

     in reply to

     Redhat statement:

     https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance

   • Embed this notice
     #/usr/sbin/rtheren (rtheren@social.linux.pizza)'s status on Friday, 03-Oct-2025 19:57:07 JST #/usr/sbin/rtheren

     in reply to

     @GossiTheDog So it's just a GitLab instance that was breached? Ok...could've been much worse.

   • Embed this notice
     kjpax (kjpax@cyberplace.social)'s status on Friday, 03-Oct-2025 22:45:34 JST kjpax

     in reply to

     @GossiTheDog Always makes me laugh when they say, "We have now implemented additional hardening measures"

     Why not just harden it properly in the first place 😂

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 06:36:56 JST Kevin Beaumont

     in reply to

     LAPSUS$ have now listed the breach at Redhat on their portal.

     They have posted CER - Consulting Engagement Requests, very sensitive info, for AMEX, Atos, HSBC, Walmart, NHS Scotland amongst others. I have authenticated the data is real.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 06:38:47 JST Kevin Beaumont

     in reply to

     • BrianKrebs

     Shout out to @briankrebs btw who noted, correctly, that the nickname being used for Crimson Collective posts was prior linked to a member of LAPSUS$ in the UK (who is supposed to be remanded in custody - the NCA may want to check he doesn't an Amazon Fire stick in his cell.

     https://infosec.exchange/@briankrebs/115305533621595786

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 06:45:28 JST Kevin Beaumont

     in reply to

     This is the portal post btw, basically the extortion note (not all of it).

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 07:11:36 JST Kevin Beaumont

     in reply to

     The LAPSUS$ Red Hat dump also has a file tree up - 370,852 directories, 3,438,976 files

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 20:56:35 JST Kevin Beaumont

     in reply to

     The Red Hat Consulting LAPSUS$ saga continues - in the past hour they've released a 2.2gb ZIP file.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 23:28:12 JST Kevin Beaumont

     in reply to

     I think a whole bunch of orgs probably need to start rotating certificates and such. #threatintel

   • Embed this notice
     0xF21D (0xf21d@infosec.exchange)'s status on Tuesday, 07-Oct-2025 05:02:52 JST 0xF21D

     in reply to

     @GossiTheDog that file tree is now zero length by the way. I tried downloading it multiple times and each time I end up with nothing.

   • Embed this notice
     0xF21D (0xf21d@infosec.exchange)'s status on Tuesday, 07-Oct-2025 05:10:39 JST 0xF21D

     @GossiTheDog alright, thanks. I was looking at the txt file becuase it said "tree" at the end.

   • Embed this notice
     0xF21D (0xf21d@infosec.exchange)'s status on Wednesday, 08-Oct-2025 00:28:49 JST 0xF21D

     in reply to

     @GossiTheDog did you see all the Ansible playbooks for Apache Guacamole?