Buy Me a Coffee

This space is available for sponsoring Ransomware.live Contact us to sponsor this space

Logo SINBON Electronics Co., Ltd

Group: Dragonforce

Discovered by ransomware.live: 2026-01-02

Estimated attack date: 2026-01-02

Country: TW

Description:

SINBON Electronics, a leading Taiwanese maker of electronic components that partners with firms such as ASML Holding N.V. and trades under the ticker 3023.TW, posted a notice on the Taiwan Stock Exchange about a cyber-attack on its network. The statement claimed an unknown group carried out the attack, that it was quickly detected and blocked, that a specialized organization would successfully decrypt the files, and that no data were taken. In fact, none of that is accurate. The breach was not anonymous. We always disclose that we performed the intrusion and include our contact information. It’s well known that no one can decrypt what we encrypt without our assistance. Any claim to the contrary has resulted in multi-billion-dollar losses for those who believed it. The incident was not resolved quickly. It unfolded over several weeks and impacted both the headquarters and the U.S. subsidiary. During our operation we exfiltrated a massive volume of company data, including executive-level information. We have now assembled a package of roughly 650,000 files for publication. The collection contains, as usual, financial and accounting records, reports, client data, and personal information. It also includes documentation of the collaboration with ASML Holding N.V., production records, and detailed evidence of product defects and the company’s financial condition. It appears the IT staff tried to conceal the scale of the breach from senior management and regulators to limit personal repercussions. That decision forced us to go public with the incident and its magnitude. We have already sent our contact details to the executives’ email addresses. Please use those details to reach out to us so we can discuss how to keep the data from being released while your company continues to grow and thrive. (The list of files prepared now isn’t final. If needed, we can expand it considerably by adding mail files and other data.)


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 3

Compromised Users: 8

Third Party Employee Credentials: 3


External Attack Surface: 23


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operations@web.com
MX Records
  • mchk.sinbon.com.
  • mlmchk.sinbon.com.
TXT Records
  • successfactors-site-verification=NzFiMTRmOTY2MDkwZjI1ODM5NGI0MmFmNTRlNTA2OTkwZjJlN2ExZGRhMTQ4MTU1YTJjOWU1MDU2MDc3YmU0NQ==
  • autodesk-domain-verification=GH0Ugijxts_sn1RcUVpZ
  • MS=ms56920265
  • MbIW62piFbZ+yWdZ6uM8iHnmWjxnfizcCC9Sms3JJuysUR7mco0rKHJL0uB+s1tTnrQVlfzvCB0RhFzDvQ6V5g==
  • JLViD25igUzAM+CHrS9Cma1HLrjJQxrXkxk/LfQbW8OL01ONF8Fz0HhBNjhpeyIzqGbnZ2FufYF+mFkCoWC6/g==
  • v=spf1 ip4:59.120.129.14 ip4:211.20.163.13 include:spf.protection.outlook.com include:_spf-dc10.sapsf.com ~all
Cloud / SaaS Services Detected
Microsoft 365 Autodesk

Leak Screenshot:

Leak Screenshot