Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo nccer.org

Group: Qilin

Discovered by ransomware.live: 2025-04-28

Estimated attack date: 2025-03-21

Country: US

Description:

With nearly 30 years of expertise in building craft training and assessments, NCCER has added Construction Leadership to its portfolio. These online programs go beyond field experience, focusing on essential leadership skills. Offering flexib ...


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 318

Third Party Employee Credentials: 0


External Attack Surface: 34


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse namecheap.com
  • deb795a42b7549fca1114f438d19559d.protect withheldforprivacy.com
MX Records
  • nccer-org.mail.protection.outlook.com.
TXT Records
  • 00df4000004kjzeeaq
  • bw=HyVkqAfm1BnqJHSJJAz0IRJ7PQIKPgazYbZsBAwzlboE
  • smartsheet-site-validation=LnCogQzLDsVQDKIOGxPjsPZ87OWmf7pc
  • extensis-domain-verification=d5feb87a-bd1a-499a-92c5-c08f148a8e9f
  • canva-site-verification=9TbpPTM32g1GDIT9NOnlrA
  • ZOOM_verify_kfQhpXSJQJyo0ZLq9xVebA
  • v=spf1 redirect=nccer.org.hosted.spf-report.com
  • openai-domain-verification=dv-4pOyJzHlWbQAQve0f0EBmtKm
  • yahoo-verification-key=NrBdDRENsFbcnbTgR2FVo5OqTQCvi2r6OHuXWj7IorY=
  • MS=ms87648918
  • mgverify=9a13c3112a520fa4142dadfd5d0568c04c6a567581a249cb2cd5eba27b52352c
  • q1fg5d2h3qp29kxvnf2yk886m9214l6r
  • apple-domain-verification=wrTP4jIxZKOMGTJE
  • 8c9cd3f70c063e3b2a58b0817e04ec0effea54f2832330e5fd
  • pardot961192=00281e57249d1ec0f6779ebeb913944f6e935357dfba37ffb8fb8d92fe50d125
  • google-site-verification=pyFEKVEe2z0EvmJT9EvwNoIqiV320OMJVd8NeTdOgVc
  • ri6lOGzWr113w+7TEA1b42uCfMIvTpW8HrVC+MCxw5k8HT/Arzez1AwvCumV615i1E3BagS0HkVXKNYuQ090Fw==
  • facebook-domain-verification=ly4surjip4rc9ku6ft26va3vfh9ohx
  • google-site-verification=VLp-xoYdNxw4bSvKLwBU36sKs1WXidww8R6G1MayYhw
  • 8JeTFgQUNUrjMwKNDLQcqb
  • atlassian-domain-verification=828JE8Ltc8ouAxh/ScSc8H0/g9iCkjr8zJLOdxeuywJI64XIcfyMptr8l3pnRQwR
Cloud / SaaS Services Detected
Apple Atlassian Microsoft 365 Salesforce Zoom

Leak Screenshot:

Leak Screenshot