Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Discovered 2026-09-24 09:57 UTC
Est. attack date 2026-09-24
Country TW
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

On August 30, HEC Group issued an official statement addressed to shareholders of TPE:3032 and other stakeholders, announcing that the company had been the target of a cyberattack. In its statement, the company claimed that the breach was detected immediately, that high-tech countermeasures were deployed, and that no corporate documentation was lost. The incident was characterized as a minimal, random occurrence. The reality, however, is starkly different. Our operation against the company began weeks prior to that publication. Due to a systemic failure to implement basic security principles, we gained nearly total control over the infrastructure supporting the development and commercial operations of the entire corporate group. We conducted a methodical and comprehensive review of the documentation, exfiltrating a vast amount of data. We remained undetected for as long as necessary to secure everything we sought. Only after completing our objectives did we initiate the data encryption process, the company's technical staff did not even detect our presence until many hours later. At the time of their official announcement, HEC Group's leadership knew the statement was entirely false. Its sole purpose was to manipulate stock market trading. Instead of contacting us to mitigate the damage, management chose to deceive the exchange. When we finally managed to contact the company's leadership and offered them a chance to make their official statement more truthful in exchange for the deletion of the taken documents, they showed no interest. If the leadership of HEC Group has decided to pursue a path of selfdestruction, we will not stand in their way. To prove that HEC Group’s statement was a fabrication and that our claims are accurate, we will now publish a portion of the exfiltrated data. This initial release will consist of over 360,000 files, drawn from a total volume measuring in terabytes. This data will provide stock exchange regulators and partner companies with exhaustive evidence of the actual events. The remaining documents will not be released publicly at this time, as we have devised a more strategic use for them. While the countdown timer below this publication runs, the companies affiliated with HEC Group, their shareholders, and regulatory authorities have time to prepare. HEC Group has one final opportunity to accept our proposal and avoid the consequences.

Exposure Report
by ParanoidLab
121
Passwords
4 critical
2
Cookies
0 critical
Last queried 2026-09-24 09:56 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • mail.hec-group.com.tw.
TXT Records
  • MS=ms89976015
  • google-site-verification=ecrUq9e9r8Cj3ZonUEqbehmMjtQ6fDrbKVBAkZt8anQ
  • v=spf1 ip4:202.39.70.160 ip4:202.39.4.69 include:spf.protection.outlook.com ~all
  • MS=46FA44B6E0D1858967C19C820DBAAF25B25614BF
  • MS=ms77180960
Cloud / SaaS Services Detected
Microsoft 365

Leak Screenshot:

Leak Screenshot