Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

McDermott International, Ltd

mcdermott.com

Group Alphv
Discovered 2023-07-26
Est. attack date 2023-04-29

Description:

McDermott International, Ltd is a global provider of engineering and construction solutions to the energy industry. Operating in over 54 countries, McDermott's locally-focused and globally-integrated resources include more than 40,000 employees, a diversified fleet of specialty marine construction vessels and fabrication facilities around the world. Incorporated in Bermuda, it is headquartered in the Energy Corridor area of Houston, Texas.

Infostealer activity detected by HudsonRock

Compromised Employees: 134

Compromised Users: 115

Third Party Employee Credentials: 172


External Attack Surface: 61


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operations@web.com
MX Records
  • mxb-00207101.gslb.pphosted.com.
  • mxa-00207101.gslb.pphosted.com.
TXT Records
  • webexdomainverification.JHLA=6c36f359-9d30-41da-bc2e-5ba7c7a37e12
  • FMZv+Qf+aViFAMKzaSguhas/tiJcSONO/AdghJ5q6vZiDRh/Nj9EeA4iyY8vQtQlHL/wpCzQhS8I23UHAEGTuw==
  • v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:spf.protection.outlook.com -all
  • cisco-ci-domain-verification=797142b679fc85d219a19bc2918e77983e0c4549536dfe167c125c47abb4e64d
  • atlassian-domain-verification=B6xdEXSVIWB1zbQfUdTFOZ5IIPao5PI7TWSYvdLE8zFHB8S39OrdCUin30zxggLk
  • MS=ms37265192
  • 11uimqlkis7q17kn9cjn03gr1g
  • 3m6pjkafja5slipb0cr1d7ptgk
  • aag8428a5r3nn6gluo6ma17hja
  • e77dks3pnp0iv1t2es4n9ja1tc
  • fqhmlvml38r3r1a1h66uoujs06
  • mdrpublicsite.azurewebsites.net
  • apple-domain-verification=cxzlqsunucpMZ8dw
  • docusign=96d98fe1-0687-4248-b29a-710256cef3f6
  • docusign=d5966640-6e54-469d-8217-c564279edd24
  • autodesk-domain-verification=qTSF_QOc37RoI6R5pqzE
  • ms-domain-verification=e2e85c56-4839-4a80-af0e-3bf9d75a3ce0
  • 368129217C151D2241D890300A56CA57BA2C935528496A05C0BCF0966965A6BA
Cloud / SaaS Services Detected
Apple Atlassian Microsoft 365 Autodesk Cisco DocuSign Proofpoint Cisco Webex

Leak Screenshot:

Leak Screenshot