Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo HYPERTHERM.COM

Group: Clop

Discovered by ransomware.live: 2025-11-21

Estimated attack date: 2025-11-21

Country: US

Description:

[AI generated] Hypertherm is a global organization based in New Hampshire, USA. Founded in 1968, the company specializes in the design and manufacture of advanced cutting systems such as plasma, laser, and waterjet cutting solutions. Hypertherm products are employed in sectors like construction, shipbuilding, and manufacturing. They provide software, controls, and consumables for cutting applications. The company is also known for its employee ownership model.


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 342

Third Party Employee Credentials: 2


External Attack Surface: 81


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusecomplaints markmonitor.com
  • whoisrequest markmonitor.com
MX Records
  • Hypertherm-com.mail.protection.outlook.com.
TXT Records
  • atlassian-domain-verification=xxqQZdLaPY6LjOCJCeesc0DBhv0OjdtylsrQyYgGbzBLZ03RaJR8WTA2MrDN+Z0B
  • 3b8cf9ad2376d9b8a95c73a989d4b3263167bba6
  • 0Z9ow3XUvVrZtlUkbdwJ9CnR05KaJHBjb0Uh77S4jDBXKEGbRz47s2M7WCxcDUNRAbl+YC7UXzJVxP8EkZ9TZg==
  • MS=ms17587318
  • sending_domain298082=6215419e02b6ad674550d6858374fa7ee9be098224c16392778eba18a8d4fb09
  • d365mktkey=cisHStQJ10hlwkGxHCgAzlgXrJzNkU5yCMG0H7nBNlQx
  • d365mktkey=obUZvf6GTG8Tf4R16z0dV7opX1opuMrl6zXhtyWGKgIx
  • unity-sso-verification=806c0bad-018c-4c01-ba15-b80866649b94
  • google-site-verification=iIvKHOub-MV_L0F00PT5DvUHFgWTztCfERmAcjk8mPs
  • docker-verification=81c42ee8-fec2-4d18-bd31-ee9a38b3ce7d
  • d365mktkey=NwvlxCwJWEl39ZwwOxfRkeOBCzg2tVI1NTOTZFwQG8Ax
  • onetrust-domain-verification=ab032896f2c34288ae2cd463bed05d35
  • intersight=19874c999cf9b37ec1344ee7e7eaad1c6ddc97e30d04a712ef4b612d5319549c
  • bKB9sJ2viNh1O2PE0/52LavrM2bVTfdsK0QF9wpQwd5fRmL7E6NP002WDoKOqI+oDLy103G8u2nemp8sA5sF3A==
  • docusign=2d324e9b-6d4c-464d-a8ae-7f482149d279
  • Oz8dldCs5WpdgtwY9W+8osSt4TvzNU8EAPflYpT7xp7esNk8ToXrQWzhJi1znNZDZVMCs1CS7NP1GbpXw3Sihw==
  • apple-domain-verification=oe3ykvFQM34GQ9M9
  • v=spf1 a mx include:spf.exclaimer.net ip4:72.236.28.8 ip4:72.73.127.3 exists:%{i}.spf.hc5028-50.iphmx.com include:spf.protection.outlook.com include:sendgrid.net -all
  • google-site-verification=d2VYWyl0O3UAcvYYp9X1sXjyTxNhVqAE7C33T2iB6OM
  • citrix-verification-code=7f08171a-32c0-460a-8978-a7b0ae0d0886
  • asv=dfd4bdc7f7c440aecf9da05378cd7b51
  • zapier-domain-verification-challenge=0408651c-81f4-44f7-8a85-3caaec664edd
Cloud / SaaS Services Detected
Apple Atlassian Microsoft 365 SendGrid OneTrust DocuSign

Leak Screenshot:

Leak Screenshot