Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

naffco.com

naffco.com
Group Incransom
Discovered 2025-11-20 01:44 UTC
Est. attack date 2025-11-19
Country AE
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

NAFFCO is an international manufacturer and supplier of firefighting, security, and safety products. They also offer training services and emergency responder certification. The company is headquartered in Dubai, in the United Arab Emirates. With a global network spanning over 100 countries, NAFFCO has been recognized as the unparalleled leader in fire safety. The official website of NAFFCO says:" Our success is driven by our "passion to protect"" We do not know for certain how well they protect their clients, but they could not protect themselves. We have 1TB of data at our disposal (fiscal data, internal mail, HR data, budgets, strategic development plans and much more)
Infostealer activity detected by HudsonRock

Compromised Employees: 193

Compromised Users: 105

Third Party Employee Credentials: 52

External Attack Surface: 35

Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operationsweb.com
MX Records
  • eu-smtp-inbound-1.mimecast.com. Mimecast
  • eu-smtp-inbound-2.mimecast.com. Mimecast
TXT Records
  • al2tojj0c3r8rmgepnlvce82ng
  • tuht6uqo506f2agdulp8ndmsjm
  • OXa7SNhXH7EpVwwbaQYcwRFwXHX6s/gtxhXkylWTrSvw7Ee8GEiOem01cS2RBMeF+Sv1Cy761WeBljIbk0j7Bg==
  • VvHJ+0h7xdK3wk//abvg1s0Lqpj4AcM+4EwtuQE+lerj/CWJ/9VmWxmhuMpTIOYBcjs/gIy0hh5JxzKsYxedew==
  • pbui8adcb7nfblo70mefgofdlf
  • 8fmk23fr5neustst4lq3gt18r9
  • anthropic-domain-verification-6whr8c=h3FK4RlL6nDEStRNulWj5nZaa
  • c3g2vapbu3b3lr2irluiidcjrn
  • 7fbch93q8rvdrg7q7pa22ei8cu
  • 5mi8biotrrl4gb36uf367nump8
  • cq1n452ssysjvyxbf4ghk7xk2cnylkkc
  • 7gvj73lvo60qnqb1dh8ngu8kit
  • e9jkvu5m9u008j4buj1jbc9hle
  • bj3bak06gdb69vv9fke38312vn
  • 6ieqdr15v4etsr4bud2s4qh8i6
  • v=spf1 include:zeptomail.net.in include:eu._netblocks.mimecast.com ip4:151.253.145.165 ip4:172.104.53.46 ip4:54.240.85.29 ip4:54.240.85.30 include:spf.protection.outlook.com include:spf.exclaimer.net include:mail.zendesk.com -all
  • qaqekbh7fa739ht0aqkb77fs7v
  • 5d1kt923vaaj53cspeaebgtgds
  • 3oj2gcs979qjdbn549ff92jeh4
  • cisco-ci-domain-verification=79b9fd1e8b725f280e0344b2fd9eef1ad81b9b174041d42ca0ebf28b63f036d7
  • 3kvtb4m700c8qsbxl81m5t717q7j65bs
  • aqa00ilnjoh47gbdrdeeg6v2r2
  • google-site-verification=xsgCsCyZQ8fWoJ3AD0-5mLnUZV08Td3VCWM6Vlm8vDo
  • 494d8dc99f9d4e578cdfb2a99d05a1fa
Cloud / SaaS Services Detected
Anthropic Cisco Mimecast Zendesk

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.