Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo www.mgrc.com

Group: dispossessor

Discovered by ransomware.live: 2024-04-19

Estimated attack date: 2022-11-20

Description:

Persons responsible for data leakage: Dave Whitney:Accounting Officer, Controller, VP dave.whitney@mgrc.com dwhitney@mgrc.com +1 925-453-3196; Tara Wescott:Head of HR, President, President, Human Resources, VP, VP, Human Resources tara.wescott@mgrc.com +1 415-312-1602 +1 925-321-1363; Krissy VanTrease - Whitney:Division Manager, VP krissy.vantrease@mgrc.com kvantrease@mgrc.com; John Skenesky:Division Manager, VP jskenesky@mgrc.com +1


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 1

Third Party Employee Credentials: 2


External Attack Surface: 2



DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operations web.com
MX Records
  • d157493a.ess.barracudanetworks.com.
  • d157493b.ess.barracudanetworks.com.
TXT Records
  • n2AVs3Bx
  • 57f0739578779745df19205bea14b6479f9ef51f28b348130188a6bf1bfa2741
  • 64b602f97c1273860f43527cb45084895d637d02
  • docusign=f5f05f2f-ea23-4c91-99ca-00f66cc7994f
  • 5607-1041-16EA-0B93-44F5-7D56-DD82-C942
  • pardot581563=0c80ed595622f211308af6b69adccc8d0b51a57853fe2695a065072fde26e998
  • sending_domain1035773=3336db8aed70b164a19249cd49c85ca4360288ae41de4d04db63ee817018db8c
  • docusign=ab8388c9-224b-483b-ac3a-ba685cb81e39
  • v=spf1 ip4:205.251.168.162 include:spf.ess.barracudanetworks.com ip4:64.47.168.0/24 ip4:64.47.172.0/24 include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.brainier.com -all
  • Security code:SWO-SUW-RLX
  • MS=ms71578464
  • sending_domain581563=907ec5227914eec0194dc3b111717dd61caf83efae1bd5efb937e5393734c417
  • csZ4K60ySIAeaTkk/6f/0VxQJXCVwt7v4B0YaP5VQ0A9Sg8vbu0f00dt86tWTK8+YEj9hgPTmpbw1jeINno1wQ==
  • e0686643e0f2d4a033663a74a8929da0
  • pardot1035773=a1f6d68e48b4808cd4ca83710145f99ee4c7125ac861cf7ae882e39d177757ce
  • asuid.store=8B2235C66029DE136D17B7D164E32C7A9DDC4E9096A85F50398B5E30BE56F20B
  • apple-domain-verification=hbqEw5LEjKIKRDZ7
Cloud / SaaS Services Detected
Apple Microsoft 365 Salesforce DocuSign

Leak Screenshot:

Leak Screenshot