Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo Goodwin College

Group: Qilin

Discovered by ransomware.live: 2025-12-28

Estimated attack date: 2025-12-28

Country: US

Description:

N/A


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 19

Third Party Employee Credentials: 14


External Attack Surface: 11


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • d139944b.ess.barracudanetworks.com.
  • d139944a.ess.barracudanetworks.com.
TXT Records
  • HHxFVardlBNniV1bJEr/1aRBjL+9wDAyn21L17O/bhpHtVbH9g72rAWhIGcQ/uQjKxrBpsUeqvSKyqNMVqL76Q==
  • apple-domain-verification=6RJzOImUTAkcWcUZ
  • logmein-verification-code=TXlbehqgooSCXEccZ6ibTSHq0
  • include:amazonses.com ~all
  • MS=33243084B2359B022A77072399832C9227DC74CF
  • v=spf1 a:mail.goodwin.edu +ip4:209.59.129.10 +ip4:207.210.153.73 +ip4:173.192.193.205 +ip4:198.187.196.0/24 +ip4:169.47.134.243" " include:spf.ess.barracudanetworks.com include:hobsonsmail.com include:spf.protection.outlook.com -all
  • DirectFedAuthUrl=https://login.microsoftonline.com/6270845a-0fb2-489e-a4f9-b473c243a306/wsfed
  • gebnvr6kv5vivevqd759l8ff8t
  • ah3l1u5q7c8rnmdkghke0v6a25
  • +include:ne16.com ~all
  • +include:outboundmail.blackbaud.net ~all
  • b1fb9940d04b6138743149eda024c851
Cloud / SaaS Services Detected
Apple Amazon SES/WorkMail LogMeIn

Leak Screenshot:

Leak Screenshot