Red Cross Hack Linked to Iranian Influence Operation?

Summary: The International Committee for the Red Cross disclosed in January that hackers stole personal data on more than 500,000 people receiving Red Cross and Red Crescent assistance, and the ICRC later said the intrusion began Nov. 9, 2021, via an unpatched critical vulnerability, CVE-2021-40539. KrebsOnSecurity reported that the email address used by a RaidForums seller offering the ICRC data, kelvinmiddelkoop@hotmail.com, also appears in an FBI search warrant affidavit tied to domains the FBI says were used by the Iran-originating Liberty Front Press influence network.
Key Takeaway: The seller, posting as Sheriff, sought $3,000-$4,000 per Cobalt Strike license and up to $35,000 for access to a data broker platform, and a RaidForums affiliate said a victim paid a $1.35 million ransom of which he received only $350,000 - the scale at which this actor is transacting.

Read the original at Krebs on Security ↗

Topics: Cybercrime & Law Enforcement
Mentions: CVE-2021-40539
Related: CVE-2021-40539: Zoho Manage Engine ADSelf Service Plus Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon) Cyber Risks ·
Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026