subway.com
subway.com
Group: lockbit3
Discovered by ransomware.live: 2024-01-21
Estimated attack date: 2024-01-21
Country:
Description:
The biggest sandwich chain is pretending that nothing happened. We exfiltrated their SUBS internal system which includes hundreds of gigabytes of data and all financial expects of the franchise, including employee salaries, franchise royalty payment...
🕵️ Infostealer activity detected by HudsonRock
Compromised Employees: 18
Compromised Users: 11980
Third Party Employee Credentials: 16
External Attack Surface: 112
DNS Records:
The following DNS records were found for the victim's domain.
WHOIS Emails
- domainabuse cscglobal.com
MX Records
- fwh-mail-onmicrosoft-com.mail.protection.outlook.com.
TXT Records
- EmEjLLL4QADoazTzqtvan1bv6YMyVFwGL2jNXpikJzhI8o//7A6fOpAcg1iqih5QidRx9U0i2lae15h3PWY8Xw==
- adobe-idp-site-verification=c780fdf0a32f6f8ca3d2aed6a01d69016c27b9182374f34214ba80e9ea81f931
- amazonses:WouvrcaLNwm9MeOA8mPHl3iSO4PJt4GRJpbhFF3crDw=
- 2paqitupt4v2gfj371i85act53
- apple-domain-verification=b5CpkBhV8vIzZtP8
- google-site-verification=bUgaQaOMKw_x8QqEELf8-07tgm1Rk0ojsUl0wJr7qJ8
- tlJrgGGNYW1T6TOpf3LBRcwsOaS3gelSZgfy60SdzvpTW5WpiAHY4v/hdv/R7WxtcYJ7HF1bBKjSFk7iX6T2tA==
- amazonses:lQ7e4of+cGMztoZEmpEpxOv439FwHEC4BXhcspQhdY4=
- onetrust-domain-verification=0423cc8be9fc48a6a8221dbb3b6df59d
- amazonses:IVt2mlynAK3WsbvNCsXkHJ/Jwoec4Vn7PuhiYJpSGt8=
- facebook-domain-verification=9411x4korp3etqeg7zd5ihfmhimgbz
- ecostruxure-it-verification=650a765a-c7dc-49a6-85ef-63d7ae790f21
- v7cehmoklrdicplaf13ac8k2ua
- d365mktkey=4vh8zlupmija2mggwyfzad1yv
- smartsheet-site-validation=WtEHNAAL4WG877SNeundsGrK2ks3oevQ
- amazonses:rfeDc6IPwWwqIeXxLTkMIFIehh1+o5FR+AEIBPo+aDM=
- flfivcv809cpb8tv46a1ims5pa
- MS=ms45332749
- d365mktkey=27h4szq8axqtjclmkrdhoydvx
- cloudhealth=b7d0679d-5571-410b-8073-7c7483a0aed9
- CpWwpQX5DV75F+ZKWAyCyNDUxbYo4InxXeA0PTtdjTCuoo1nm1F6BnEU/LMCxoQsHSQEcffbI4tufAWu8lwICw==
- Dynatrace-site-verification=37764e30-4ee4-403b-a66b-f2dacc3a7734__6vthkjdn478aftj5kmo2ghajeo
- Dynatrace-site-verification=da9ae839-07f7-479f-a048-f3c40b64337c__ovr7cl3o83h6v8k6sgf7qac8nt
- onetrust-domain-verification=e353972587624065aec066201135b725
- GtuUJJbOSsufY0shVDZxs5FXpBrxJCCVyF/V3rBqKtzqdGEdfAfFd/cx8n7J71VUE1GGoDLjFYW44q5uEmZ0UQ==
- apple-domain-verification=ZePlie9LX2l3lM7J
- docusign=5d070834-6746-415f-8a1c-48a729c4928e
- _xb3hf9ozq4ftpre79rej7cr3hdm9xnk
- 3bcvb797i9bokin5jdb6np2r3k
- v=spf1 mx ip4:205.210.145.0/24 ip4:67.20.173.128/26 include:spf.protection.outlook.com ~all
Cloud / SaaS Services Detected
Adobe
Apple
Amazon SES/WorkMail
Microsoft 365
OneTrust
DocuSign
Leak Screenshot:
