{"id":431,"date":"2025-10-02T08:55:52","date_gmt":"2025-10-02T11:55:52","guid":{"rendered":"https:\/\/boasvindas.engdb.com.br\/?p=431"},"modified":"2026-04-06T12:18:54","modified_gmt":"2026-04-06T15:18:54","slug":"urgent-red-hat-compromised","status":"publish","type":"post","link":"https:\/\/boasvindas.engdb.com.br\/?p=431","title":{"rendered":"URGENT: Red Hat Compromised"},"content":{"rendered":"<p class=\"x_x_MsoNormal\"><span lang=\"EN-GB\" data-olk-copy-source=\"MessageBody\">Dear colleagues,<\/span><\/p>\n<p class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Red Hat has confirmed a\u00a0<b>major security incident<\/b>\u00a0involving its\u00a0<b>private GitHub repositories<\/b>.<br \/>\nThe extortion group\u00a0<i>Crimson Collective<\/i>\u00a0claims to have stolen approx.\u00a0<\/span><b>570 GB of data<\/b>\u00a0from more than\u00a0<b>28,000 private repositories<\/b>, including:<\/p>\n<ul type=\"disc\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Consulting and engineering reports with customer infrastructure details.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Developers\u2019 private repositories and internal code.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Sensitive artifacts: API keys, CI\/CD secrets, VPN profiles, pipeline configs, architectural diagrams.<\/span><\/li>\n<\/ul>\n<p class=\"x_x_MsoNormal\"><b><span lang=\"EN-GB\">Main risk<\/span><\/b><span lang=\"EN-GB\">: the stolen data may enable targeted attacks against customers and partners (phishing, supply-chain compromise, use of exposed credentials).<\/span><\/p>\n<p class=\"x_x_MsoNormal\"><b><span lang=\"EN-GB\">Required actions<\/span><\/b><\/p>\n<ol start=\"1\" type=\"1\">\n<li class=\"x_x_MsoNormal\"><b>Immediate credential rotation<\/b>\n<ul type=\"circle\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">API keys, GitHub tokens, VPN credentials, CI\/CD secrets.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Revoke any certificates or SSH keys potentially shared with Red Hat.<\/span><\/li>\n<\/ul>\n<\/li>\n<li class=\"x_x_MsoNormal\"><b>Log review &amp; active monitoring<\/b>\n<ul type=\"circle\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Check for anomalous access to critical systems, pipelines, and cloud environments.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Pay attention to logins from unusual IP addresses or timeframes.<\/span><\/li>\n<\/ul>\n<\/li>\n<li class=\"x_x_MsoNormal\"><b>Pipeline and build environment validation<\/b>\n<ul type=\"circle\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Verify integrity of CI\/CD pipelines.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Compare current configs against approved baselines.<\/span><\/li>\n<\/ul>\n<\/li>\n<li class=\"x_x_MsoNormal\"><b><span lang=\"EN-GB\">Enforce strong MFA &amp; just-in-time access<\/span><\/b>\n<ul type=\"circle\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Mandatory MFA on GitHub and connected systems.<\/span><\/li>\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Minimize duration and privilege of temporary credentials.<\/span><\/li>\n<\/ul>\n<\/li>\n<li class=\"x_x_MsoNormal\"><b>Report anomalies immediately<\/b>\n<ul type=\"circle\">\n<li class=\"x_x_MsoNormal\"><span lang=\"EN-GB\">Any suspicious activity must be reported to the internal SOC (<\/span><b><a title=\"mailto:csirt@cybertech.eu\" href=\"mailto:csirt@cybertech.eu\" data-ogsc=\"rgb(80, 136, 236)\" data-linkindex=\"5\"><span lang=\"EN-GB\" data-ogsc=\"\">csirt@cybertech.eu<\/span><\/a><\/b><b><span lang=\"EN-GB\">,\u00a0<\/span><\/b><b><a title=\"mailto:security@eng.it\" href=\"mailto:security@eng.it\" data-ogsc=\"rgb(80, 136, 236)\" data-linkindex=\"6\"><span lang=\"EN-GB\" data-ogsc=\"\">security@eng.it<\/span><\/a><\/b><b><span lang=\"EN-GB\">\u00a0)<\/span><\/b><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><span lang=\"EN-GB\">Thank you for your cooperation and vigilance.<br \/>\nThe situation is evolving: further updates will be shared as soon as available.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p class=\"x_x_MsoNormal\"><b><span data-ogsc=\"rgb(85, 85, 85)\" data-olk-copy-source=\"MessageBody\">Group Information Security Office<br \/>\n<\/span><\/b><span data-ogsc=\"rgb(85, 85, 85)\"><a title=\"mailto:Security@eng.it\" href=\"mailto:Security@eng.it\" data-ogsc=\"rgb(80, 136, 236)\" data-linkindex=\"7\">Security@eng.it<\/a><br \/>\n<b>Engineering Ingegneria Informatica<\/b><br \/>\nPiazzale dell\u2019Agricoltura, 24 &#8211; 00148 Roma (RM)<br \/>\n<a title=\"https:\/\/link.pblc.it\/c\/519666493?alt_obj=hre&amp;method=email&amp;url=http%3A%2F%2Fwww.eng.it%2F&amp;hash=f5e191&amp;chk=299220-15e70a\" href=\"https:\/\/link.pblc.it\/c\/519666493?alt_obj=hre&amp;method=email&amp;url=http%3A%2F%2Fwww.eng.it%2F&amp;hash=f5e191&amp;chk=299220-15e70a\" data-auth=\"NotApplicable\" data-ogsc=\"rgb(80, 136, 236)\" data-linkindex=\"8\">www.eng.it\u00a0<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dear colleagues, Red Hat has confirmed a\u00a0major security incident\u00a0involving its\u00a0private GitHub repositories. The extortion group\u00a0Crimson<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":4,"featured_media":432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-seguranca"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/boasvindas.engdb.com.br\/wp-content\/uploads\/2025\/10\/redhat-scaled.jpg","_links":{"self":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=431"}],"version-history":[{"count":3,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/431\/revisions"}],"predecessor-version":[{"id":435,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/431\/revisions\/435"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/media\/432"}],"wp:attachment":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}