Contact us Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Logo

National Museum

natmus.dk
Group Thegentlemen
Discovered 2026-06-15 12:58 UTC
Est. attack date 2026-06-15
Country DK

Description:

***.dk zoominfo.com/c/national-museum/372526094 The National Museum of Denmark, located in the heart of Copenhagen, is the country's premier institution for cultural history, spanning from the Stone Age to the present day. It houses world-renowned archaeological treasures—including Viking hoards, the ancient Sun Chariot, and the Egtved Girl—alongside extensive global ethnographic collections. The museum is dedicated to exploring and sharing Denmark's rich heritage and global human history through engaging, research-driven exhibitions
Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 1

Third Party Employee Credentials: 1

External Attack Surface: 2

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • natmus-dk.mail.protection.outlook.com. Microsoft 365
TXT Records
  • +R/D6wFsfho1BFtr+vlBiS1dQxUQAxeaGSlkwOamwicZfhULnKrJaMoyTgabN6/5DUOMz6gRhn+2EUa3FIT9dQ==
  • v=spf1 include:_spf.sitnet.dk include:spf.protection.outlook.com ip4:50.31.32.0/19 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:81.27.209.53 ip4:86.58.175.4" " ip4:194.182.159.206 ip4:5.56.144.185 ip4:13.93.34.69 ip4:35.190.247.0/24 ip4:35.191.0.0/16 ip4:86.58.175.12 ip4:89.221.166.0/24 include:spf1.natmus.dk ~all
  • apple-domain-verification=eB7ifSIwqqGMcTq1
  • MS=ms64809324
  • facebook-domain-verification=2ef83dkw061yk0migeudgi95pfq4oj
  • atlassian-domain-verification=fH95ZzaUCMQvZTeVGd7taMGYdhlYATGlzy8n7lGHsfGg1ouI6B4s0mCbvRokFmMD
  • google-site-verification=ElCXAOQ64JtGQrdh8TMl1JpJ_EXckfPFl0Yv-U6HKGs
Cloud / SaaS Services Detected
Apple Atlassian Microsoft 365

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.