Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Group Mimori New Group
Discovered 2026-10-20 13:44 UTC
Est. attack date 2026-10-20
Country GB
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation
This is an emerging group, so this claim should be treated with caution until independently verified.

Description:

AVEVA is a British multinational industrial software company headquartered in Cambridge, England, and operating as an autonomous business unit of Schneider Electric. It provides engineering, design, operations management, data visualization, asset performance, and cloud-based industrial intelligence solutions for sectors including oil and gas, power, chemicals, manufacturing, marine, mining, and infrastructure. AVEVA's technology helps thousands of enterprises worldwide optimize industrial processes, improve operational efficiency, and support digital transformation across complex engineering and asset lifecycle management. Sector: Technology - Files: 177234 - Publication planned: 2026-10-23T19:09:39Z

Infostealer activity detected by HudsonRock

Compromised Employees: 1257

Compromised Users: 995

Third Party Employee Credentials: 58


External Attack Surface: 124


Infostealer Distribution

Exposure Report
by ParanoidLab
16389
Passwords
2929 critical
5017
Cookies
8 critical
Last queried 2026-10-20 13:44 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusesafenames.net
MX Records
  • aveva-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • atlassian-domain-verification=qxaJ3toCEa/YX2MFbjioQf+aZcFnz2jRRbttvEz4cQobpezYBbpttenCuGjQbao9
  • d0858ae7c13e0f4fa5fc0decf44303d8ec4b5305781e57c95b
  • adobe-idp-site-verification=558564823c30a37985e4a883b59c2c4bb9d914d0b1aadee1e5a3085ffae82233
  • b5myqs3mw6xxcqqbm2v4h86gt54j4l1x
  • v=spf1 exists:%{i}._i.%{d}._d.espf.agari.com include:%{d}.ec.spf-protect.agari.com -all
  • 0ed1fe018aea62e701465049bea6a5165edfbdc66d
  • 45ffqm6hg4nlyqbqw084t2rm0v29hdp7
  • mindmanager-verification=12775b032eace177101c88d6034417f3b50c0ed9126a830f6d9ceaa2b8ef2512
  • nzFB/M2olLz9K706x59hIFUY pvGXjTbNVAW0ZFuFgxcc0qXIUoIcJvZ xRwgxVrsXF4KeOYJ4rBDjIXFDqVww==
  • amazonses:pESmGK2ZtPrdnzyObOqS+EBA+N5nU7+pF6T++DufHHc=
  • atlassian-domain-verification=/SmdaJaNXO8ka47VB7SBxLKsFi754zE/9UBOmMy7v904YlTdziKi4OkhuyTFljnC
  • miro-verification=34c922e4f94ff8a15fd6a3e4c9203a6aab538e0e
  • _3kczsxbiaay0721cvgnrechruelg062
  • google-site-verification=FkD8DPsTCenbup7h9kAcIzO12KKDXYLUueJsDHtm308
  • v4tf1j09w636kvp4xzf78q7gb2bfy5ym
  • cloudflare_dashboard_sso=8d2d187015fc4d76e38e3e57effe32f4
  • flexera-domain-verification-dromxhshvsdlfymm
  • _cl6ws2tsbwx7n9tnb8sun2dghaa86wh
  • apple-domain-verification=ZxLmL73ns3Ik2LLX
  • h0qgrj5p3n6j1d9gpcfytzh1z7v0k490
  • docusign=e2e28dda-2aec-452f-9509-6edbb8534512
  • bw=pTdtMNMqDDj5pbyDCdM1Qwo6bkFL0dTLI6Tv03tfYOUM
  • MS=ms68952420
  • _lenv1lysmvf40r0lmmav216m9lmu15l
  • 275991f714204ed4925acfce70256021
  • stripe-verification=1EC10921C2A6D74A2586B7B96268C8171D1CA1BEB1877F951A7812173E9FA750
  • _globalsign-domain-verification=yW6SbkTqnuFXZBySBRWg96tGoQMb9oUK1QdltZ6gZ1
  • google-site-verification=YgmZ3Xn_J75jGc-Mp0dYYdP7nVvqC6N1GO0gd7XdmkY
  • drift-domain-verification=5c78007e1fac7ca543acea9e49cd4743962b0d8ca66a83550643f8f5d34ed25b
  • pendo-domain-verification=aea875d3-5563-423c-9085-4c48c0ffe8ae
  • a8440b8c8c56bcc587c15cda80c6bc6f2cddd8957a22d42091
  • wrike-verification=MTg5MTAwNTo2ZjM3YTA2YmVjMjdlZTA1OGE0NzVkOWYyOTViNmZiMDM2NzkwNjdlOWNiZjAyODk0YzM4NDc0MDc1ODA2NzM0
  • docker-verification=043ba2a9-3654-4178-86c3-2f060b3d85b6
  • nzFB/M2olLz9K706x59hIFUY+pvGXjTbNVAW0ZFuFgxcc0qXIUoIcJvZ+xRwgxVrsXF4KeOYJ4rBDjIXFDqVww==
  • google-site-verification=bTsI29XEm0sCpCGPQ4cEdMV48nXAR9xMnCketGNhGFw
  • smartsheet-site-validation=2WvGr3rfDdbDWqe-dc89ASD0hWA-324Q
Cloud / SaaS Services Detected
Adobe Amazon SES/WorkMail Apple Atlassian Docker DocuSign Flexera Global Sign Microsoft 365 Miro Smartsheet Stripe

Leak Screenshot:

Leak Screenshot

Other recent victims