Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Logo Castle Group

Group: Qilin

Discovered by ransomware.live: 2026-02-17

Estimated attack date: 2026-02-17

Description:

N/A


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 43

Third Party Employee Credentials: 23


External Attack Surface: 14


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse@enom.com
MX Records
  • mxa-00a16401.gslb.pphosted.com.
  • mxb-00a16401.gslb.pphosted.com.
TXT Records
  • google-site-verification=b3hYehtUCy-3h_9av8jwA6jSs-yvCZtNI8esb0MDZ3w
  • pardot1074592=aabdea0bfd886c3731eabd06e3b5eb640a34f6e0ce32897a692d854b6936b205
  • sending_domain1074592=f815a4505adf6065248f6d6d20d8a5724d365ff9df0fde4a71fd58f491f4b5a4
  • thcy642vpqbyj6059rcqqnmwflf3370h
  • v=spf1 include:spf.protection.outlook.com include:mailgun.org include:mail.zendesk.com include:_spf.salesforce.com ip4:170.55.119.2 ip4:208.86.168.7 ip4:148.163.151.27 ip4:148.163.154.227 include:docebosaas.com ~all
  • 75A50AC48E
  • MS=ms63720790
  • amazonses:9IQKwy0rY9qbTpzcGEC8z0QxMp6p5FDemK1PU5KECRQ=
  • amazonses:H+Q8vau7J3GiKqd5EJFYQHnVq0EgbzHHH7NCr++W57M=
  • dropbox-domain-verification=u5qtv9ar404n
  • google-site-verification=SsGXpyT0XCuMYUzJAIt9ZafcWqKFgSuSHocXCgtV6so
Cloud / SaaS Services Detected
Amazon SES/WorkMail Dropbox Microsoft 365 Salesforce Zendesk Box Mailgun Proofpoint

Leak Screenshot:

Leak Screenshot