Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

JONESDAY.COM

jonesday.com

Group Clop
Discovered 2022-12-22 20:02 UTC
Est. attack date 2022-12-22
Duplicate Entry
This victim has been identified as a duplicate of another entry in our database. However, this may not always be the case: the same organization can be targeted multiple times by the same or different ransomware groups, which may result in separate legitimate entries. Search for related entries

Description:

Access denied

Infostealer activity detected by HudsonRock

Compromised Employees: 3

Compromised Users: 7

Third Party Employee Credentials: 4


External Attack Surface: 7


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operationsweb.com
MX Records
  • mxa-00393202.gslb.pphosted.com. Proofpoint
  • mxb-00393202.gslb.pphosted.com. Proofpoint
TXT Records
  • _59jc2wxzibuqauemxgizq69he4r39lo
  • _7g4wkcin1xw4qdffpz560xonpiheix8
  • _tx1ba9rkjhwafd852esxh957hgbxwny
  • yb7sg53hy1lk80k07l3dr9jhzrqxps7y
  • zn9xt2zqdwwy259ld54gxh42q05jln88
  • 1password-site-verification=AGVGV234V5EFRIAEXANW6KASP4
  • v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all
  • onetrust-domain-verification=901afca52afc453893d6ad24f59d2e93
  • pardot1130242=a34f121426cefb1b17aa83f392a906244a1710577907ac62da58f9c550fcd267
  • duo_sso_verification=WTopcrhHM0bZXnqKUfnMeIptReCaHXdrHVn817d7GOGFRBwYkawNI5UaFltMfhc6
  • sending_domain1130242=92789fc7216e425005e5b687b63fa04b5bdb9bcc4651cf73c4463128a6310bf8
Cloud / SaaS Services Detected
Cisco Duo OneTrust Proofpoint Salesforce

Leak Screenshot:

Leak Screenshot