Red Hat Hackers Team Up With Scattered Lapsus$ Hunters

According to Dark Reading, Crimson Collective, which recently breached the GitLab instance of Red Hat Consulting, has joined the Scattered Lapsus$ Hunters cybercriminal collective. The group is said to have claimed a breach of 28,000 Red Hat repositories and to possess customer engagement reports, with claims that CERs include secrets from Red Hat Consulting clients.

Over the weekend, security researchers observed Crimson Collective aligning with Scattered Lapsus$ Hunters, a coalition said to comprise Scattered Spider, Lapsus$, and Shiny Hunters members that claimed responsibility for Salesforce breach campaigns. A leak site listing 39 organisations that had Salesforce instances compromised via vishing attacks included a Red Hat listing, which purportedly dated the breach to 13 September with an 10 October ransom deadline.

Red Hat has not publicly commented on the leak site post beyond noting that its Red Hat Consulting GitLab instance was self-managed on GitLab Community Edition, and Dark Reading notes that the group appears to be using the leak site for extortion. The article also covers Rapid7’s findings on Crimson Collective’s activity in AWS environments and advises organisations to avoid long-term credentials and to scan for secrets in code repositories.