Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Knottingham Trent University

ntu.ac.uk

Discovered 2026-08-25 14:24 UTC
Est. attack date 2026-08-25
Country GB
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access after stealing the following below High-Risk Sensitive PII - Passport Numbers & Details: Stolen via the raw PDF copies of the applicants' physical passports - Dates of Birth: Specifically exposed on the main data profile screen - Nationalities & Countries of Birth: Confirmed via the legal passport logs and the registration metadata fields. Contact & Location PII - Full Legal Names: Animesh Shukla and Abhinand Unnikrishnan - Personal Email Addresses: Exposed via the portal login view (`[REDACTED]@leveragemails.com`). - Mobile Phone Numbers: Explicitly collected on the dashboard contact view (`7080809422`). - Permanent & Correspondence Home Addresses: Complete street-level addresses mapping out exact house numbers, apartment complexes, districts, and postal ZIP codes spanning across Lucknow (226001) and Delhi (110024). Academic & Professional History PII - While non-sensitive on its own, hackers use this deeply personal context to write highly convincing scam letters - Complete Academic History: Stolen via the raw transcript files (`Degree Transcript.pdf` `10TH`, and `12TH` grade completion papers), showing exact grade percentages, modules studied, and prior school names. - Employment & Professional History: Stolen directly out of the `CV.pdf` file, mapping out their previous job titles and career timelines - Professional Reference Names: Stolen via the Letters of Recommendation (`LOR.pdf`), which reveal the names, titles, and institutions of the professors or employers who recommended them. mirror 1: https://anonfilesnew.com/[REDACTED] mirror 2: https://pixeldrain.com/[REDACTED] This is a warning to all companies to comply it's that easy and simple. If you don't we will leak you and ruin your reputation and make sure that everyone abuses your companies data.

Infostealer activity detected by HudsonRock

Compromised Employees: 787

Compromised Users: 2937

Third Party Employee Credentials: 256


External Attack Surface: 156


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • ntu-ac-uk.mail.protection.outlook.com. Microsoft 365
TXT Records
  • workplace-domain-verification=qUnHCkD87L3nWvfPq4DnpHeqvXMm5r
  • google-site-verification=-HX2V-6qAoFxpCwhrI287Gd_LF_TBzcntZOgcEKK3_Q
  • brevo-code:08ff5ed4a343c2591bb9bb37af9e421d
  • google-gws-recovery-domain-verification=69394460
  • msfpkey=6zc08ci9ku1alw03svailenfn
  • apple-domain-verification=GD8o5262x12OLP79
  • google-gws-recovery-domain-verification=69614898
  • google-site-verification=-pCFxCJjuTjG9UqhZlELUbc5U7VtutktR67wnjYX5Wo
  • globalsign-domain-verification=mjp3mboVpnc22gDvBwhtFGi1_zbfEdjw2_jPInZrc6
  • 370F0B5AA3B1149E4B7BA036D27B5E86DB8244E29F279A9E6FEEA7C356B62951
  • _globalsign-domain-verification=H6ZpZYhJEP0xbq6J8V47NkLD59NA99KNfFD79rGvKy
  • adobe-idp-site-verification=c6b83e10d88946776564ddd39ba1934da88fadbabf69f14985e56c9d7cd2504a
  • 50D75908AEBE64C905050975D096B7E0BD99DB6769C38DE6E68FFD050F690696
  • QuoVadis=e35e114a-9eb4-4136-9ef5-b5cb98da7d9d
  • jamf-site-verification=bUwskBTDcqgBbL4sdibhAA
  • MS=ms52600687
  • google-gws-recovery-domain-verification=73001927
  • ms-domain-verification=5405e580-9e5e-4024-8882-a42cebec9430
  • google-site-verification=5TmlWWmi5d5NLm1EHN_eqHpPBuonT6Z7gtTMgMKdJSs
  • google-site-verification=tpM1VSPjd0JxnDV82azMEBEcmIZhUcEwpefceUixqPU
  • 1B5962E1A696C06E8EBCEA0B21E7BEBEE8177BE664DCB8E06B48E6B2AD774706
  • GLAu0H6RU+Lv87ZHCvUgms+mw7Un8RlrVfzxDv8EGJcte+d3OJRnG0l0ZVXMq13o3oXt8xCK0tnTMl/cG4C94g==
  • pvuzlkfo/1N05avbRVuluHxqsJLqSfGYQSpJmJdG22D4YyrER6XFV2Kf9VjxaGbOyEV0yz3fXNeZXxed/CABnQ==
  • v=spf1 include:_spf1.ntu.ac.uk include:_spf2.ntu.ac.uk include:_spf3.ntu.ac.uk include:_spf4.ntu.ac.uk include:_spf.salesforce.com include:spf.protection.outlook.com" " ip4:167.89.7.96 ip4:184.107.80.100/30 ip4:152.71.100.199 ip4:152.71.100.229 ip4:185.41.28.0/22" " ip4:94.143.16.0/21 ip4:185.24.144.0/22 ip4:153.92.224.0/19 ip4:213.32.128.0/18 ip4:185.107.232.0/22 ip4:77.32.128.0/18 ip4:77.32.192.0/19 ip4:212.146.192.0/18 -all
  • vONfKptSGotgzsNdIHgO1X3x2pfj9yxQ5GC7WfPFnsEzVdnx+3eRj5ykM5/3eU4XEbdztwF7wtW3CR+J/+2fzA==
Cloud / SaaS Services Detected
Adobe Apple Brevo Global Sign JamF Microsoft 365 Salesforce

Leak Screenshot:

Leak Screenshot