Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo PACCAR

Group: Coinbasecartel

Discovered by ransomware.live: 2025-11-13

Estimated attack date: 2025-11-13

Country: US

Description:

Founded in 1905, PACCAR is a global technology company in the design, manufacture and customer support of high-quality light, medium and heavy-duty...


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 31

Compromised Users: 274

Third Party Employee Credentials: 21


External Attack Surface: 111


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusecomplaints markmonitor.com
  • whoisrequest markmonitor.com
MX Records
  • paccar-com.mail.protection.outlook.com.
TXT Records
  • apple-domain-verification=V2304GEWmXftIXQH
  • amazonses:u0WRv5tCsTcIiuDYVD9EC+vF4oXjQ9wgNOLReMbg7zk=
  • nintex.65b3ab2cdf8e9e1d6d458aa0
  • autodesk-domain-verification=AZdgizNjwNBWKknSYVZk
  • docusign=987ab830-8c06-47b9-9821-3eaf31c01164
  • google-site-verification=QjVk5s2XrLPb6Tum4ZgxhIl-p4pmSdmP1VZF1XML6QY
  • v=spf1 include:spf.protection.outlook.com include:%{d}.a1.spf-protect.agari.com exists:%{i}._i.%{d}._d.espf.agari.com -all
  • 0QT5CUI16Y0DU7W813F94LOG8PTADKCRZ96CFBIM6
  • adobe-idp-site-verification=e4e71a6e67bb653d6e9345747725b1fd2739e1add40323f133df5a5c45a083e1
  • yUzMKm0HGmr0ABNjdVib6rCaOi2T0EF/q49aPiYxfZ8srOWTiEQnMU7klrD28yuvBeXsIqoCW53/Oly87wGHxA==
  • p3bwi6QknU/2qO2VDlE8TvnoFCyf89wqV6DLWybqcrEQ3rdBzW3vlYIjAO/L29Iz1XYTWvNjAeyt1tO4Mquvcg==
  • atlassian-domain-verification=BPb8fok0uuG/9ZttwtaoPkO+VjsdrlaO6/yIiqN+m7kdEh6znuaXY3RO277zTEJQ
  • ktBzeN2jxNJEc7AAoPVsEdnjIVFvMe1z7Z1bL8AhutbJi+/eW5Zcdv3h7SS66p1cl9oPnHoGLGcLV1eoRISX0A==
  • QdDXntdUL9NytubhmXxynoIn+PJR82bDEVFL9c8yjqcDwe5IKaP+tm3nF7wgsb2g0pRF7jgHL7ne5c6gWVYkiQ==
  • smartsheet-site-validation=PtuhAXZK4GPAbNcrvSvwpJysR_00z3BP
  • flexera-domain-verification-fshpeiwyamdcqvgj
  • MS=ms90877592
  • ms-domain-verification=0de671ae-c8ab-4b8c-907b-613dc04e3aec
  • hcp-domain-verification=bb0fece073b5ae109b13996ce18bcef3ce51622d2e01ce72f32b462884b9ba93
  • vmware-cloud-verification-06dbfc7b-e8b9-42bf-9316-524ce09bb08a
  • docusign=b2607d02-d1d6-4ace-9650-0ecda4a156eb
  • cisco-ci-domain-verification=1b9029458f486534bac5da32b8933c1139bf202ab39777308539c4912ce79e05
  • airtable-verification=9b7f0b6f654c7f298c7eccffbe661a4a
  • 25k20ebp16lpgjcap9bfh0o1ku
  • sendinblue-code:058f461322ee8ae36f17dc7236f1689e
  • google-site-verification=OWpDXFizFhWNfyRnWzC7cVUe0VE2LFYPLtkTstZ-7s0
Cloud / SaaS Services Detected
Adobe Apple Atlassian Amazon SES/WorkMail Microsoft 365 Autodesk Flexera Cisco DocuSign

Leak Screenshot:

Leak Screenshot