Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Logo Aegis Project Controls

Group: Dragonforce

Discovered by ransomware.live: 2026-02-28

Estimated attack date: 2026-01-26

Country: US

Description:

Aegis Project Controls is a construction company providing 4d scheduling, training, and construction scheduling services. 214GB of files, projects, and documents that threaten US national security. These include projects on military-critical facilities (Space Fence, Nitrocellulose Facility, etc.), biosecurity laboratories (USAMRIID), critical infrastructure facilities, and others. We know you didn't contact the FBI after the attack on your infrastructure, but now the FBI will come to you. We advise you to contact us immediately; your IT department knows how. You have 15 days before this data is made public. Dear David J. Hatwell (+1 269-673-8962, +1 360-918-3187, +1 240-331-0437), we promise you public shame and the destruction of your company if you don't pay. Time has begun.


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 0

Third Party Employee Credentials: 1


External Attack Surface: 1


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse@godaddy.com
MX Records
  • consultaegis-com.mail.protection.outlook.com.
TXT Records
  • atlassian-domain-verification=aoz8uCar0xwguGY1G0G0CcPGcnXMnvapfYkpCkGWGVYxGr/Mp8Kt0EV/d8FIf6QC
  • v=spf1 include:UniversalSpf.org ~include:x.UniversalSpf.org include:spf.protection.outlook.com include:emailus.freshservice.com include:mail.zohoanalytics.com include:_spf.intacct.com include:mailgun.org include:aspmx.pardot.com ~all
  • linkedin-site-verification=55c8844f-d781-4816-950a-dcb1629e5982
  • e606h8s70m2trgcv01u2krslo9
  • google-site-verification=MKjGgttpAqH2QFidJ-5SJFOaoW1MuyHdcC16yN0ksxU
  • apple-domain-verification=SrAuZQWrgFgtamhr
  • sending_domain1005582=a01891f23510e301a9ab3b2b502b6962b85d4edd72d8f1be371d246a73c8530c
  • MS=ms46400450
Cloud / SaaS Services Detected
Apple Atlassian Microsoft 365 Mailgun

Leak Screenshot:

Leak Screenshot