Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Logo Tan Chong Motor Holdings Berhad

Group: Crypto24

Discovered by ransomware.live: 2025-07-16

Estimated attack date: 2025-07-09

Country: MY

Description:

We have exfiltrated over 300GB of sensitive data, including Customer databases (all dbs of tanchong - NAV, BRASSTAX, VTS, CRM, E-INVOICE,...),Legal and HR documents, Financial and employee records, Contractual documents with partners and customers.


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 9

Compromised Users: 86

Third Party Employee Credentials: 63


External Attack Surface: 42


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • lawrence.wong@tanchonggroup.com
  • compliance_abuse@webnic.cc
MX Records
  • tanchonggroup-com.mail.protection.outlook.com.
  • tanchonggroup-com.in.tmes.trendmicro.com.
TXT Records
  • tmes=4122ef3fa00c68a73870a95cbe8c9a8a
  • v=spf1 include:spf.protection.outlook.com include:spf.tmes.trendmicro.com ip4:211.25.100.128/25 ip4:202.188.134.0/25 ip4:210.245.3.160/29 ip4:113.161.58.214 ip4:113.160.87.34 ip4:118.69.187.65 -all
  • 63P155CNGV4369AHVA4KXBNN9DBEIQBUTZQFLRIT
  • MS=916EA967D3A739C9FDD585C9F43D99A6124EFDFE
  • MS=ms46685854
  • MS=ms69170145
  • VXXGUHJNMD9U21BAM287EPMDM30SF0I4OSWO4WSO
  • W2UBOVMLAJXR68CK39AT0XF9REIOIBYBE1HVC9PQ
  • amazonses:HflR3XoW4D9gCs+4Qtk8yxPH1557AYRFvtuNt0fBfhM=
  • brevo-code:7cbff0215dd6d4da62d3868302a203e8
  • brevo-code:b56eb170cd1a662b51e59e19fab3d71c
  • firebase=tceas-mobile
  • google-site-verification=q0Qdd2EoAMQ4JxvSCAhHaHha4-YRe6QNkzScfDYX9yA
Cloud / SaaS Services Detected
Amazon SES/WorkMail Microsoft 365 TrendMicro