Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

MCH-GROUP.COM

mch-group.com

Group Clop
Discovered 2022-12-22 20:02 UTC
Est. attack date 2022-12-22

Description:

403 Forbidden

Infostealer activity detected by HudsonRock

Compromised Employees: 2

Compromised Users: 34

Third Party Employee Credentials: 1


External Attack Surface: 8


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse1api.net
  • infodomain-contact.org
MX Records
  • mchgroup.mail.protection.outlook.com. Microsoft 365
TXT Records
  • swisssign-check=xM0bS2foWkF4SZY63rkYYOob4fS6vCpuuZYSxJOTL8
  • jamf-site-verification=5GYowAutgXkswaPwrj-XUg
  • 5ZxbpkW8DkN4iSHiA33RlaCoRrd8iiNHWgsxz0Uu8mB2p/24J9/5Gcz9rb3GQqo4g7XFNGOpTV9lSms9fv9ygw==
  • miro-verification=f820664be80c35f6be9603629fb31bfdc7e17569
  • docusign=a73d43b4-1811-4b24-92a6-c85501ec5080
  • v=spf1 mx ip4:194.124.201.0/24 ip4:194.124.202.0/23 ip4:83.169.28.81 ip4:62.55.182.68 mx:mch-group.com a:mx01.rexx-systems.de a:mail.intevo.info a:vwp5104.webpack.hosteurope.de include:spf.protection.outlook.com include:_spf.salesforce.com include:spf.mai" "ljet.com -all
  • apple-domain-verification=YTeQgoPDGVUBH1st
  • openai-domain-verification=dv-ZKW5094NJMRjiDnN6DfWrVPM
  • _xll2l9radjqblwcsnj2bycorbatosr2
  • facebook-domain-verification=gxifbdgsmslfpxw7c42rdnd5chwv0a
  • E3CE886F-341D-49B8-881B-EE02E119D9E4
  • _hh23w3w8udxughmssrjizrwnoh7f786
  • f5Azl5g6o8zByXpkNz4YX7epqY/OHwAJd93XOALdDcGibTfd1AoVwJSRM/NO19ok4D2l3i/W0/uRx8223Zc2QA==
  • t0fhzzk3y547r6zd7z8ct5gcwn13wwkl
  • atlassian-domain-verification=zaOaKCtB7E/inzNb0aONFHgO4qVboo5RCes68u1nIeHkxmt83tVfklAF1CkcAVm/
  • 45dfk9t901p5fbmhrkx5b5zj07sctshq
  • xj+y0gXPFrrQ7ihK/jdG4UifnqLyWdZFD0cPyGerR1f2wtVp3RP7iYGvAWtOs5lhdBnS9d0SMQYDuF091ZXVXg==
  • 5WCpOuNaCAhLXXfQFceeF6JAVU+/ZIhDYhhyJXrdXkPDhReebvDrEdUnV29HOuNivfDl+M4qwuRGb47g2TPeZw==
  • MS=ms45117108
  • QuoVadis=e05812aa-958b-4c9d-a44d-739791b83d21.
  • ms-domain-verification=6e24b65c-5988-4e75-abde-393ce904733b
  • 0187501D-1F84-4B59-BFB1-350747D86BE5
  • anthropic-domain-verification-xtf4mh=pWFEeHkoSriHOQLcDw0qVO0Yo
Cloud / SaaS Services Detected
Anthropic Apple Atlassian DocuSign JamF Microsoft 365 Miro OpenIA Salesforce

Leak Screenshot:

Leak Screenshot