Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

COLORADO.EDU

colorado.edu

Group Clop
Discovered 2022-12-22 20:02 UTC
Est. attack date 2022-12-22
Country US

Description:

Home - University of Colorado Boulder

Infostealer activity detected by HudsonRock

Compromised Employees: 68

Compromised Users: 14835

Third Party Employee Credentials: 482


External Attack Surface: 132


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • colorado-edu.mail.protection.outlook.com. Microsoft 365
TXT Records
  • brevo-code:5f9e8714a4a7c561eb4cdf0848811c11
  • docusign=dcb8d5d8-71e8-4884-8604-02297bea8072
  • atlassian-sending-domain-verification=0b36ce8f-b8ec-42ae-8513-2264ea6d72e7
  • bMFGPNmrr7aoZsBWqexbujPiPjVzJe4wrZfl/t81eGptVxvkprdRSqKfj3paVrFcRhsrQHBlMGIR86eXUIYbCw==
  • brevo-code:814ad43e9f25b1a52d6a2b213fcfae73
  • bw=E1ibKK7mvTTWmq1SV+b/usJyVdN63EU+WFJh+SCp+abE
  • jamf-site-verification=V7i5P5-QM02gTP25eIhZIA
  • d365mktkey=gzYMp5Xcnapx0VINCqRrvMtsD0TBSpLsrFjihN9HWQAx
  • v=spf1 ip4:128.138.1.0/24 ip4:128.138.48.0/20 ip4:128.138.64.0/18 ip4:128.138.128.0/17 ip4:204.228.68.0/22 ip4:132.194.255.30 ip4:136.147.136.157 include:_spf1.colorado.edu include:_spf2.colorado.edu ~all
  • google-site-verification=iaVX54MaxYscXlrL-DxuE9qtvLhAXkXKhG8sjiH5q-0
  • brevo-code:d6b523305300718643a7da77b3feeccb
  • docusign=7412fd08-3676-471a-8b65-8cc2b13c8137
  • d365mktkey=CgcAzx2nkxamTBkNT7jagrT8Nadf6LPzlI0MLQHdKA0x
  • brevo-code:ac843dd83e2d2a3d8becd980f7193d9b
  • atlassian-domain-verification=QAg9aEn1gpS7HapLhSZbdUei9wTKTCl8EKYsTFg5su7bO2Pu30QtUg9QsGZzz1Vw
  • yahoo-verification-key=LBMWN06qx3V2Edw1euv/698yUrWMNip2Dx3Y4yyVmYE=
  • openai-domain-verification=dv-5hwuyXiWaOnaq12vb3n73azV
  • MS=ms27269994
  • _3x6w07ujdy2wk71two4k8r4mwmtw6tq
Cloud / SaaS Services Detected
Atlassian Brevo DocuSign JamF Microsoft 365 OpenIA

Leak Screenshot:

Leak Screenshot