Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo balboabayresort.com

Group: cactus

Discovered by ransomware.live: 2024-09-04

Estimated attack date: 2024-07-19

Country: US

Description:

Download link #1:  https://***************.onion/BBS/PROOF/Mirror:  https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/BBS/PROOF/DATA DESCRIPTIONS: Personal Identifiable Information, employees\executives personal data, customer information, financial data, contracts, corporate correspondence, etc.


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse godaddy.com
MX Records
  • balboabayresort-com.mail.protection.outlook.com.
TXT Records
  • v=spf1 include:spf.mailjet.com include:spf.protection.outlook.com include:cust-spf.exacttarget.com a mx include:sendgrid.net a:smtp-out.daytonanetworks.com a:smtp-out2.daytonanetworks.com a:smtp-out3.daytonanetworks.com include:balboabayresort.com ip4:167" ".89.85.15 ~all
Cloud / SaaS Services Detected
Mailjet SendGrid

Leak Screenshot:

Leak Screenshot