ammega.com
ammega.com
Group: cactus
Discovered by ransomware.live: 2024-03-11
Estimated attack date: 2024-02-16
Country:
Description:
Download link #1: https://***************.onion/AMMEGA/PROOFMirror: https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/AMMEGA/PROOFDATA DESCRIPTIONS: Accounting\treasury\taxes 250GB+, HR - payrolls\personal documents\dossiers 150GB+, Customer data - projects\contracts\drawings 100GB+, Engineering\R&D\QA 250GB+, Legal documents, corporate correspondence 100GB+, employees' personal folders... Lots of corporate confidential data, employees Personal Identifying information, executive managers personal data, legal documents including lawsuits, contracts, etc. PRICE: $9MFILE TREE PRICE: $90K
Compromised Employees: 22
Compromised Users: 5
Third Party Employee Credentials: 26
External Attack Surface: 5
DNS Records:
The following DNS records were found for the victim's domain.
- domainabuse tucows.com
- ammega-com.mail.protection.outlook.com.
- pardot854583=8835b7f7c13ca7461956ac46871cd3650888fa74c5f567206658d8362b5f7bda
- MS=270A4BBB505A6984F69DD2BA7B1A14203AA9D367
- ms-domain-verification=9cb415ce-0266-4e65-8b69-25be7ea3020f
- MS=ms69889785
- da2c3b371f25366ad847dd0d78a0e67f6e70ce64e6e759514b
- apple-domain-verification=5sVTvY2c9TlfCbvR
- Vkl-JX2-zlb
- ciscocidomainverification=46668d019bd38a78b6cb40a62a536d1c71f82d99d86ecbb315172aa6fbbd1825
- _globalsign-domain-verification=AufPn5mHfWR0GpyUOLa80nTVmOkUPleorEckvEf3WM
- v=spf1 mx a include:spf.protection.outlook.com include:et._spf.pardot.com include:spf1.ammega.info include:spf2.ammega.info include:spforacle.ammega.info include:spfinclude.werkonline.nu include:_spf.salesforce.com ip4:207.211.63.183 ip4:208.116.180.100 i" "p4:208.116.180.104 ip4:162.218" ".1.205 ip4:162.218.1.206 ip4:162.218.1.150 ip4:162.218.0.230 ip4:54.240.57.47 ip4:54.240.57.46 ip4:68.179.109.125 ip4:40.107.6.49 ip4:82.193.164.111/32 ip4:80.197.60.32/29 ip4:154.14.55.140 ip4:69.174.127.2 ip4:14.201.108.59 ip4:123.243.157.179 ip4:123.24" "3.64.43 ip4:27.33.174.170 ip4:60.240.234.251 ip4:14.200.111.59 ip4:192.200.190.165/30 ip4:104.195.80.16/28 ip4:192.200.181.144/28 ip4:174.37.85.64/28 ip4:75.126.150.248/30 ip4:63.141.144.128/28 ip4:104.195.127.0/28 -all
Leak Screenshot:
