Executive Summary
In September 2025, Red Hat confirmed a security incident involving unauthorized access to a GitLab instance used by its consulting business. The threat group, Crimson Collective, claims to have exfiltrated nearly 570GB of compressed data from approximately 28,000 internal repositories, including around 800 Customer Engagement Reports (CERs) containing sensitive infrastructure details, authentication tokens, and database URIs. The attackers allegedly leveraged these credentials to potentially access downstream customer environments. Red Hat stated that no other company services or products were affected and initiated remediation steps shortly after detecting the breach.
This incident highlights a growing trend of threat actors targeting source code management systems and leveraging poorly secured credentials to escalate access. It underscores the importance of robust secrets management, Zero Trust segmentation, and stringent access controls across cloud-native development environments.
Why This Matters Now
The Red Hat breach demonstrates the urgent need for organizations to secure internal development platforms like GitLab, as attackers increasingly exploit these to gain deep access and extort both enterprises and their customers. With supply chain attacks and extortion campaigns on the rise, proactive detection and least-privilege controls are more critical than ever.
Attack Path Analysis
The attacker initially compromised Red Hat’s GitLab instance, likely via exposed credentials or token misuse. They escalated privileges to access sensitive repositories and consulting reports. Lateral movement occurred as the attacker pivoted through repository secrets to potentially access additional resources, including infrastructure and downstream customer environments. Command and control were maintained through persistent access mechanisms and covert communication, enabling data staging. The threat actor then exfiltrated a large volume of sensitive data, including internal repositories and customer reports. The impact phase culminated in extortion, leak threats, and reputational risk to Red Hat and affected customers.
Kill Chain Progression
Initial Compromise
Description
Attacker gained unauthorized access to Red Hat's GitLab instance, likely using stolen or improperly secured credentials/token found in code or CER files.
Related CVEs
CVE-2025-4278
CVSS 8.7An HTML injection vulnerability in GitLab's search functionality allows attackers to execute arbitrary JavaScript, potentially leading to session hijacking.
Affected Products:
GitLab GitLab Community Edition – 18.0.0, 18.0.1
GitLab GitLab Enterprise Edition – 18.0.0, 18.0.1
Exploit Status:
no public exploitCVE-2025-5121
CVSS 8.5A missing authorization vulnerability in GitLab Ultimate EE allows authenticated users to inject arbitrary jobs into CI/CD pipelines, potentially leading to credential theft or lateral movement.
Affected Products:
GitLab GitLab Ultimate Edition – 17.11.0, 17.11.1, 17.11.2, 17.11.3, 18.0.0, 18.0.1
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Unsecured Credentials
Brute Force
Data from Cloud Storage
Exfiltration Over Web Service
Resource Hijacking
Data Encryption for Impact
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for Access to CDE
Control ID: 8.2.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management
Control ID: Art. 9(1)
CISA ZTMM 2.0 – Credential and Token Security
Control ID: Identity Pillar - Credential Protection
NIS2 Directive – Supply Chain Security
Control ID: Art. 21(2)(c)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Red Hat GitLab breach exposes critical supply chain vulnerabilities affecting authentication tokens, database URIs, and development repositories across software engineering organizations.
Information Technology/IT
Data theft incident compromises consulting engagement data containing infrastructure details and configuration information critical for IT service providers and operations.
Banking/Mortgage
Customer Engagement Reports breach exposes Bank of America and financial institutions' network configurations, requiring enhanced zero trust segmentation and threat detection capabilities.
Health Care / Life Sciences
Mayo Clinic and Kaiser healthcare data exposure in consulting reports creates HIPAA compliance risks requiring encrypted traffic protection and anomaly detection.
Sources
- Red Hat confirms security incident after hackers breach GitLab instancehttps://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/Verified
- Security update: Incident related to Red Hat Consulting GitLab instancehttps://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instanceVerified
- GitLab Patches Critical Account Takeover and Pipeline Hijacking Vulnerabilities - Red-Team Newshttps://redteamnews.com/red-team/cve/gitlab-patches-critical-account-takeover-and-pipeline-hijacking-vulnerabilities/Verified
- Security Advisory 2025-020https://cert.europa.eu/publications/security-advisories/2025-020/pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, egress policy enforcement, east-west traffic controls, and continuous anomaly detection could have significantly limited attacker movement, contained exposure, and prevented large-scale data exfiltration at several points within the GitLab and associated cloud environment.
Control: Multicloud Visibility & Control
Mitigation: Visibility into access patterns and policy enforcement could have detected anomalous GitLab access.
Control: Zero Trust Segmentation
Mitigation: Limits access scope and lateral privileges based on strong identity policy.
Control: East-West Traffic Security
Mitigation: Blocks unauthorized internal traffic between workloads and environments.
Control: Threat Detection & Anomaly Response
Mitigation: Real-time alerting and behavioral analytics detect persistent C2 or staging behaviors.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents unsanctioned outbound transfers, even using covert/allowed protocols.
Minimizes blast radius and business risk by ensuring ongoing inline policy and control.
Impact at a Glance
Affected Business Functions
- Consulting Services
- Customer Support
Estimated downtime: 7 days
Estimated loss: $5,000,000
Unauthorized access to 570GB of data from over 28,000 repositories, including approximately 800 Customer Engagement Reports containing sensitive client information such as network configurations and authentication credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation and identity-based policy to lock down access to cloud apps and internal repositories.
- • Enforce robust egress filtering to control data flows and prevent unsanctioned exfiltration.
- • Deploy continuous east-west traffic monitoring to spot and halt lateral movement arising from compromised credentials.
- • Enable anomaly detection and real-time alerting on sensitive resources and privileged actions within cloud and SaaS platforms.
- • Regularly scan code and configuration repositories for embedded secrets, rotating credentials and enforcing least privilege at every layer.
