Group:
Cactus
Discovered by ransomware.live: 2024-11-01
Estimated attack date:
2024-10-15
Country:
Description:
<p>Colleges & Universities.<br><br>“LSST aims to support the government's widening participation policy that focuses on ensuring every student has an equal chance to further their education. LSST has successfully operated partnerships with the University of West London and London Metropolitan University, since 2013 and 2016 respectively.”<br><br>Website: <a href="https://www.lsst.ac/">https://www.lsst.ac/</a><br><br>Revenue : $72.2M<br><br>Address: 4 Dunstable Rd, Luton, Bedfordshire, LU1 1DX, United Kingdom<br><br>Phone Number: +44 1582729486<br><br><mark class="marker-yellow"><strong>Download link #1:</strong></mark> <a href="https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion/LONDONSST/PROOF/">https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion/LONDONSST/PROOF/</a><br><br><mark class="marker-yellow"><strong>Mirror:</strong></mark> <a href="https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/LONDONSST/PROOF/">https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/LONDONSST/PROOF/</a><br><br><mark class="marker-yellow"><strong>DATA DESCRIPTIONS:</strong></mark> Personal identifiable information, confidential corporate documents\correspondence, financial documents, students and staff personal data, etc.</p><p><img src="/uploads/21915877_Passport_8fe6c64a5e.png" alt="21915877 Passport.png"><img src="/uploads/Emils_Sviklans_Passport_e3082f1005.png" alt="Emils Sviklans Passport.png"><img src="/uploads/Madalina_Petrache_ID_EU_Passport_2551031a57.png" alt="Madalina Petrache ID (EU Passport).png"><img src="/uploads/Yoseph_Mengesha_Maziga_New_Passport_front_and_back_de46d21f3d.png" alt="Yoseph Mengesha Maziga - New Passport front and back.png"><img src="/uploads/Carol_Isaia_Mate_Passport_f06520ea6a.png" alt="Carol-Isaia Mate - Passport.png"></p>
Infostealer activity detected by HudsonRock
Compromised Employees: 9
Compromised Users: 207
Third Party Employee Credentials: 23
External Attack Surface:
29
DNS Records:
The following DNS records were found for the victim's domain.
- eu-smtp-inbound-1.mimecast.com.
- eu-smtp-inbound-2.mimecast.com.
- amazonses:LvDqVkuC29NJ3V8PadskiVEE3DpMP3ezK2fOtPaoUSU=
- nqck9mmrvsqqq4g5rkfcf8hrjc
- logmein-verification-code=dbf824f1-1918-4301-9b93-28d5319b9590
- pff3r18oura9no3o9iaa82ro73
- tcl6skn9enr3hninvj6d1r1coo
- kt61ivfkn2u872nlo82f0e20n7
- c180sb4rjng4ll6vv3lelg0cnn
- v=spf1 a mx ip4:20.162.120.167 include:eu._netblocks.mimecast.com include:spf.protection.outlook.com include:amazonses.com -all
- 1kf8t3djpueopf4k39oh1d4rbh
- 6el9m947ccs5i7rmdqh16refhs
- apple-domain-verification=v2YmjCOdbSaaqF2d
- oasaf59nhdvom83vf8hie3obg6
- f8s218dm9fg5dcj6q4pg7jdedt
- MS=ms30227092
- 0ed1fe018a0ee9d17d6b334c0ebe8d85033cd458e4
Cloud / SaaS Services Detected
Apple
Amazon SES/WorkMail
Microsoft 365
LogMeIn
Mimecast
Leak Screenshot:
Legal Disclaimer:
Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
This platform indexes only publicly visible information posted by ransomware operators and
open web sources without accessing or obtaining the underlying stolen content.
The service is provided to support public awareness, legitimate research, and cyber-resilience.
No stolen personal or confidential data is collected or distributed via this site.