Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

EDAG.COM

edag.com

Group Clop
Discovered 2022-12-22 20:02 UTC
Est. attack date 2022-12-22

Description:

Ihr ganzheitlicher Engineering-Partner - EDAG Group

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 6

Third Party Employee Credentials: 15


External Attack Surface: 4


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain-abuseinternetx.com
  • nwadminedag.de
MX Records
  • edag-com.mail.protection.outlook.com. Microsoft 365
  • weedag.mail.protection.outlook.com. Microsoft 365
TXT Records
  • _globalsign-domain-verification=WMZBVEHR3EeWw4CHWyDxiswmizORxt3bUNWzwTuwT-
  • v=spf1 ip4:193.141.91.7 ip4:193.141.91.6 ip4:193.141.91.4 ip4:193.141.91.64 ip4:80.156.190.52 include:spf.protection.outlook.com include:_spf.edag.com -all
  • google-site-verification=6QGfIjihxE5wYiG8Zv-SpovapvUkYCAx3V4fZA4vArU
  • _globalsign-domain-verification=6G2hN7YNp1co9Pff3fVehNcvx3cC5ZvWfd8PsviSN1
  • _globalsign-domain-verification=6UcvN0zXiwO08jjjo7h4rvP_VGFr6IrJjAwIWIeTsF
  • mindmanager-verification=498f5fbc64890cf8daf0ef093aae639099c5d66838bce24498c4903d186957b8
  • google-gws-recovery-domain-verification=46309085
  • miro-verification=b7a5d07e932ce219e8c7c706e81d043be9fbd216
  • google-site-verification=QSIdDa8fnNHZeByn-xNC8RR_YKv_8srGWzUlfGW-wIU
  • google-gws-recovery-domain-verification=40194998
  • _globalsign-domain-verification=5up3mh8vZW1MeQbSPo3UqogSllSJlFW6WFlwBmTtdn
  • asuid.ai-quickcheck-admin-dashboard\",\"DD0E39E4C4A965CA380DAA024532626CDA73C7A43F0A039DB1DBF1ADC0CB32D3
  • google-gws-recovery-domain-verification=40946791
  • MS=ms82197334
  • google-site-verification=qT7fg1wzRE98UIwZtrPr1Js-6XQxeghrjlDd5xxK_Yo
  • google-site-verification=7otH9Zz9YFNwk4lkDP1JiGtGukuXTj_rqZpGtFyo6K8
  • teamviewer-sso-verification=66c9a640d5ad441a88c1ffec4494a70e
  • docusign=5455e6c4-a794-4166-993a-dee112170a9d
  • cisco-ci-domain-verification=1860bf53b5cde4930b18051f6c280fa0cd11083cdd35523283d8afde8ae4ecfe
  • apple-domain-verification=R1hmihCfwN4QeJBX
  • google-site-verification=QGVdWh4WoigyYQFqRIL5IeQ5_oFpWHj1gzxHC3bnWfA
  • _globalsign-domain-verification=GF_9MOKdkCRvtlsuFxeod1On2b_5ahZkwAdS7aIDeT
  • _globalsign-domain-verification=mX2z6criS9XdGOivioKt2D9bPPwlyPjrPq2_DB4TOC
Cloud / SaaS Services Detected
Apple Cisco DocuSign Global Sign Microsoft 365 Miro Teamviewer

Leak Screenshot:

Leak Screenshot