Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Metro

metro.net
Group Thegentlemen
Discovered 2026-09-07 21:52 UTC
Est. attack date 2026-09-07
Country DE
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

metro.net zoominfo.com/c/metro/351518795 LA Metro is the Los Angeles County Metropolitan Transportation Authority (LACMTA) — the second-busiest transit system in the US, serving 9.6M residents across 1,433 sq miles (nearly a third of California's population), founded in 1993 by merging SCRTD and LACTC. Its network: 125+ miles of rail (2 subway + 4 light-rail lines, 110 stations), 117 bus lines, 2 BRT corridors, 2,000+ low-emission buses and the Metro Micro on-demand service — moving ~925,000 weekday boardings and 305.7M riders in 2025 (9 straight months of growth, +9% YoY, 87% satisfaction). It's run by a 13-member board (5 county supervisors + the LA mayor's bloc, chaired politically by Mayor Karen Bass) and led by CEO Stephanie Wiggins — the first woman and first African American to head the agency — with a $9.7B FY2026-27 budget and a $26B capital program, the largest rail construction program in the US.
Infostealer activity detected by HudsonRock

Compromised Employees: 10

Compromised Users: 259

Third Party Employee Credentials: 9

External Attack Surface: 56

Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • metro-net.mail.protection.outlook.com. Microsoft 365
TXT Records
  • ibmid=30acd2ad-1eb9-47fc-a49c-c292eecc5cc7
  • facebook-domain-verification=4i5u9peoiulaxisnrjsgttxx829j0i
  • 00DVB000006yz6n=1TBVB0000000BBZ
  • 7d7d1512-spf.mta.getcheckrecipient.com
  • v=spf1 include:spf1.metro.net include:spf2.metro.net include:spf3.metro.net -all
  • google-site-verification=5uJYdCvQ2ohr3Ja-naibbiWc3V_10fpRObYjLld0mBI
  • wLkL5xgnCEDpN6Oq6Tmy8nbaVGnvtaoRiDOkC8ds9bg=
  • lacmta.net=_uysygnrnpa5dqwseddnoalswypxwk3n
  • xrGyJoJrTkAj9Qr7cBCTLYciEW+V219vf5R1nqyKjMwPD2EGAt1A4IDrBvOBqx6Ua83P3pU8km5Xy6Znn3oOvQ==
  • google-site-verification=0dLSu7sJzajW1ncESkSlSiSODVsKGHKlyKHwKOkr4x4
  • apple-domain-verification=UTYMbr9cdhCmo4N5
  • cisco-ci-domain-verification=60f25bd63484e134c8c37d8bff46d04b268e27428e91620d7cd44c8a1ff939d6
Cloud / SaaS Services Detected
Apple Cisco

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.