Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

BMW Алдис

bmw.com

Group Malas
Discovered 2023-04-09 14:57 UTC
Est. attack date 2023-04-09

Description:

using Zimbra vulnerability

Infostealer activity detected by HudsonRock

Compromised Employees: 18

Compromised Users: 756

Third Party Employee Credentials: 36


External Attack Surface: 104


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domainabusecscglobal.com
MX Records
  • mx1.hc324-48.eu.iphmx.com. Cisco/IronPort
  • mx2.hc324-48.eu.iphmx.com. Cisco/IronPort
TXT Records
  • facebook-domain-verification=7qshqm5nhxp077vc3pjcuzh8prtzzf
  • brevo code: 5a69ccf2dd3a7bc1ff89aecae02fa1ba
  • google-site-verification=y48_Huwdcv0YgVkAv4d-hd7WFAjJtr_tn9FH-vjUu34
  • webexdomainverification.=4c5b1d7e-e1b7-43e2-9587-901191bcdab4
  • MS=ms60515415
  • swisssign-check=eENFu58YUH3CHEi08F3ZMqIqLnw
  • google-site-verification=cbI25QNli6OEtZxKtPDv0glH3A0SkB-nWQ-aZt8Tr9E
  • bw=v4xoqexo2ugAIXVT1hrePr6lKOBtWdCjjn2dPoipHKjA
  • wiz-domain-verification=2571e83621dca3f606c3fd4bedd8cef9bc52af789f348c55e7cada9bcbdc7791
  • google-site-verification=7qhHl1QEE0eXqplmX6Fyvn6NlQMKseN4ScxwyjqSNM8
  • v=spf1 include:2b39h9s0b.spf.checkpoint-spf.com include:spf.protection.outlook.com -all
  • dtm-domain-verification=w-jHB4WHAyl24Me5RLoyL9meYMTmSRq7v33vNxLJK3s
  • _globalsign-domain-verification=rgXvALvL9BGEP_inpF7I2lpQLatdKVJmkulFfiS1m_
  • google-gws-recovery-domain-verification=55334320
  • IjFiuUOj36RbwTO8cBQddNhQgCOFQ9ZWYisbdZ4T9aI=
  • MS=ms55083425
  • adobe-sign-verification=15bb0cf14babc7e7f78038ee6a1fcdb9
  • Dynatrace-site-verification=b7c1e591-49bf-46db-aea0-4ba1064710cc__h9acrq10pl6aodc853ofh936se
  • google-gws-recovery-domain-verification=54945363
  • _globalsign-domain-verification=Bg6RK_AQsh0j4FYIDmqripBhaDLJv1OEpNYW-fCfqV
  • swisssign-check=341DMPaCC2b3M3fP2ezROypWplM
  • webexdomainverification.=dc6328a3-9618-44e7-8569-95a5c6118407
  • 4996ceae-a56f-4270-877a-6434650eaa1a
  • atlassian-domain-verification=tH2LhIuI8YV9tLrL3RpNDPKBrBnLILxDAowQt8J1igpJNPKIK2a4uGhBaLuymeDh
  • teamviewer-sso-verification=a6e196c021384748a6a28f9a586cbfcc
  • xb4vsm2k8p7kh17fhjf3hcr593bllf63
  • _globalsign-domain-verification=7K67NoJHKSxuL2KsQVatK9FvHj28XGsIRqaJyy27pY
  • figma-domain-verification=f5a46a65e2d42080d654af335b6273251110ad997b78d6b48edbe1df807c3726-1775568205
  • webexdomainverification.=30df38a5-6fc4-4b16-85a4-c52cd45e1740
  • cisco-ci-domain-verification=77c5ff0ea7e9edf0c6bca294ff8ba9a2342ad0de45a960a21631fb9b1f1f03db
Cloud / SaaS Services Detected
Atlassian Global Sign Microsoft 365 Teamviewer Cisco Cisco Webex

Leak Screenshot:

Leak Screenshot