Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Group Endzone
Discovered 2026-09-21 09:20 UTC
Est. attack date 2026-09-21
Country US
Sector
Not Found

Description:

Revenue: $221.7 million Momentum is a telecommunications company founded in 2001 that provides cloud-based communication solutions for businesses, specializing in cloud voice services, managed networks, SD-WAN solutions, and Microsoft Teams Phone integration. We gained access to a diagnostic and provisioning tool used by Momentum through a compromised Multi-Service Operator (MSO). Upon reconnaissance, we identified multiple critical vulnerabilities throughout the system. This tool controls internet and voice services for millions of users across global markets. We successfully accessed user data for every MSO, exposing personally identifiable information (PII) for over 7.5 million users. They didn't notice the prolonged access or the customer data dump for a while, but when we started deleting modems they noticed. They kept burning access and we gained it back, they'd burn it again. We removed modem packages for 58,127 users across the United States. That's 58,127 people without internet service right now. Families, businesses, students all cut off from the digital world. This is the direct result of their negligence and failure to secure their systems. These services can be restored immediately with the click of a button on our tool but you must reach out. Momentum management should contact us to discuss resolution.

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 4

Third Party Employee Credentials: 7


External Attack Surface: 3


Exposure Report
by ParanoidLab
544
Passwords
81 critical
2
Cookies
0 critical
Last queried 2026-10-05 19:08 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • systemsmomentumtelecom.com
  • domainabusetucows.com
MX Records
  • us-smtp-inbound-2.mimecast.com. Mimecast
  • us-smtp-inbound-1.mimecast.com. Mimecast
TXT Records
  • MS=ms22320960
  • 0ed1fe018ab2c867dee5e248a3b9f75cb7eef2b22c
  • v=spf1 include:us._netblocks.mimecast.com ip4:172.17.0.5 ip4:209.55.18.2 ip4:209.55.25.4 ip4:4.53.194.122 ip4:4.53.194.121 ip4:4.78.147.148 ip4:208.85.135.7 ip4:209.55.3.145 ip4:35.227.166.44 ip4:168.75.50.131 ip4:72.3.185.0/24 ip4:168.75.50.130 ip4:209.4" "2.161.44 ip4:162.244.96.24 ip4:35.184.234.127 ip4:208.184.224.19 ip4:72.32.154.0/24 ip4:64.99.180.0/24 ip4:216.40.32.0/20 ip4:207.211.30.221 ip4:207.211.30.141 ip4:192.28.158.186 ip4:70.38.100.0/24 ip4:209.172.40.80/28 ip4:209.172.40.192/26 include:_s0.mo" "mentumtelecom.com include:spf-us.emailsignatures365.com -all
  • smartsheet-site-validation=8ZzUupj4zSGbQQbA2MjtTHqqOo44epQB
  • 00D80000000aJlo=1TBPV00000005vl
  • 1password-site-verification=G4ECVVKWQNHFRKV2SL7P7GYNHA
  • 00D400000003a5U=1TBRk00000006bh
  • Jk8-Av5-Hr1
  • anthropic-domain-verification-3pdb87=267iVhrLJqbV5NTJgneaEw3pZ
  • RT3-NM0-QEW
  • cisco-ci-domain-verification=bf6989f6db31eb8ea2a07345394ad80cdb88f154fe0cb87ad89c4cdb568c056
  • google-site-verification=KpsmuPfC-DWkBu3zw0WdclCAOP3H35Tn_UCLqPwg_0w
  • apple-domain-verification=vbMVc4PvjQiWhGC8
  • xdhn0m3mpv65yz14bmzy14bc8sbc65zn
  • t8jdhpbvkyd4zf047wnp302g9cj64qyg
  • google-site-verification=tJr8SvF3sroSrJwLZxA3wzXGPwNrw_Sac7V6JZGG5s4
Cloud / SaaS Services Detected
1Password Anthropic Apple Cisco Microsoft 365 Mimecast Smartsheet

Other recent victims