Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo NovAtel (belongs to Hexagon)

Group: Qilin

Discovered by ransomware.live: 2025-11-24

Estimated attack date: 2025-11-24

Country: CA

Description:

N/A


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 47

Third Party Employee Credentials: 1


External Attack Surface: 13


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domainabuse cscglobal.com
MX Records
  • novatel-com.mail.protection.outlook.com.
TXT Records
  • pardot130511=f92477829019a303c95f02a2911f327765e10ca6cbe3e78eb239c117f577e083
  • tl09o0pii66ekdkikpiojt6lrg.
  • pardot130511=dd2840220dc07999e8c962a08403ea72378556a192d61eb2f1e3e4edc6536816
  • qv8jt6ql3vv7311t70ve5g0th9
  • pardot130511=03b799bbd9da16e5f96fe7e884065a90c43ba5390793e99cda364915e9325676
  • bNOiTrPgaPYkpBzPO3KBbxRfBvPhuz9sS8K9BUxxGmfvxIjTjS8Hk4kcjJqL89LV3b31l4HdekqL+oH+VyY2jQ==
  • pardot130511=4b26908e8aa787cd8d299ef59699f05fdad8a97c24d59de4fc1b7c5cad25b777
  • 204hjppaa4m60eta6f727rmb2i
  • 9ek4q9mkf3kq962atk8l0dsu9f
  • amazonses:4p9piCJMDZ34RfH9iZR/6dMw0X8b3TzVqp3CzRNyheY=
  • pardot130511=e4da993c4071c3361ed298ed099c8e8922309305f463c0ca77bfa92c15226276
  • v7stj0j7bq4p6u3oc7hvrntrq1
  • 93r5blioupq1l8mts0hpeh0dak
  • google-site-verification=rJclV7uIXDW61EKSYOe2er2s-jB7nHtt0mntkbcw0ys
  • 1ifcuiuhhec7cpv98lklok12kh
  • adobe-idp-site-verification=3f492195-42f0-4001-b3a2-3feaca558f5e
  • pardot130511=c8962bb3cad94520fedf48c4db6a3d5689cabf0a62d9908a48215d767c061b75
  • pardot130511=59dd3d964a55e42603731571b3eea5a5c1e2a2092c8decb41a76d4395e63da7f
  • pardot130511=90833bf2c2d48a095701aa55673b1266db50ff7ff965706e79cfbc5d8614d31d
  • v6ro3hfrrk75topm7rc2s1bpm7
  • pv98lklok11ifcuiuhhec7c2kh
  • pardot130511=af250a0dcf3cd1a03a4fdf7de6024b940542549409f06ce01cc5e5f959b1c4f6
  • pardot1083232=f6786e12d141e58282cd21e56f875df665e32c3b6fa3213a8176691a79f7285a
  • bqnm42bilpsnqrpi5col2vhmha
  • linkedin-site-verification=03aeaadb-9aa1-42af-82cf-d6513e6f50e2
  • v=spf1 include:novatel.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all
  • MS=ms11911064
  • pardot130511=61b3be4957b9284a0eab2acdf8abe72770692f866adc160689246aca3121334f
  • pardot130511=1c7fcdfbb65f2694b7c6b5ab1a1a0c8b09cc72f84e011999f21c5e8aa34bd57c
  • 9vebplg98nmehm2kujta1r2e51
  • pardot130511=4123f0362f13b583b5cd3ebdd17db754744ba2aee09073f0867a40364b2cbd56
  • V64/QjGaRiiJdwpsEzYK9OkotPcdouBgPedO41kRm1d89nfEQwXhHz2Tu4xdZT1siZQigs0viuCckFYD3H0Aug==
  • l5dlpriv4n8nh3m0so0msbdb7r
Cloud / SaaS Services Detected
Adobe Amazon SES/WorkMail Microsoft 365 Salesforce

Leak Screenshot:

Leak Screenshot