Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

United Group

united-group.in
Group Vexy Ransomware New Group
Discovered 2026-09-07 17:54 UTC
Est. attack date 2026-09-07
Country IN
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation
Data exfiltrated 116GB
This is an emerging group, so this claim should be treated with caution until independently verified.

Description:

United Group is a diversified Indian business group delivering innovative products and services across multiple industries. Founded in 2003, the company began as a food and beverage consultancy and has since expanded into food ingredients, nutraceuticals, industrial machinery, infrastructure, fashion, digital branding, packaging, and automotive accessories. With a strong focus on quality, innovation, and customer satisfaction, United Group operates through a network of specialized businesses, serving clients across India and international markets. Backed by certified manufacturing facilities and experienced professionals, the group is committed to providing reliable, sustainable, and value-driven solutions that support business growth and long-term success.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 0

Third Party Employee Credentials: 7

External Attack Surface: 0

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusewildwestdomains.com
MX Records
  • alt3.aspmx.l.google.com. Google Workspace
  • alt4.aspmx.l.google.com. Google Workspace
  • unitedgroup-in01e.mail.protection.outlook.com. Microsoft 365
  • aspmx.l.google.com. Google Workspace
  • alt1.aspmx.l.google.com. Google Workspace
  • alt2.aspmx.l.google.com. Google Workspace
TXT Records
  • sending_domain1073613=646df36d1c6cbefdc21ad9e8ec220444884a2a5315e4bdaecc47b055a11330da
  • asv=778fac7c0e01a453ea8463d239cfa8a9
  • v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:one.zoho.in include:aspmx.pardot.com include:_spf.salesforce.com include:amazonses.com ~all
  • google-site-verification=d-JfPe7s5Mdrcr5O653WYT78hGsggPcX6MExxTZxqY0
  • MS=E1CA35334A89794BE33FD6C09BAD8156218D429D
  • MS=ms32785066
Cloud / SaaS Services Detected
Amazon SES/WorkMail Microsoft 365 Salesforce Stripe

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.