Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

spsr-law.com

spsr-law.com

Group Babuk
Discovered 2023-07-31 14:36 UTC
Est. attack date 2021-07-07
Duplicate Entry
This victim has been identified as a duplicate of another entry in our database. However, this may not always be the case: the same organization can be targeted multiple times by the same or different ransomware groups, which may result in separate legitimate entries. Search for related entries

Description:

The Babuk v2.0 new

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operationsweb.com
MX Records
  • mx2-us1.ppe-hosted.com. Proofpoint
  • mx1-us1.ppe-hosted.com. Proofpoint
TXT Records
  • MS=ms17590126
  • ppe-89107efa7c502ede0fcd5e682ab21e4b16e15a6a
  • gmlnfj5s28j8nveu0vl6b5k5nj
  • duo_sso_verification=LiEV77qjdDsAcdWiIejlBl7QoPjt8gxk6Lz8ZcjazbkDElaF8yV90TlqsNlOHrBV
  • v=spf1 include:spf.protection.outlook.com ip4:38.127.0.226 ip4:64.132.233.110 ip4:38.95.195.46 a:dispatch-us.ppe-hosted.com include:electric.net include:mandrillapp.com exists:%{i}._spf.inkyphishfence.com include:spf.us.exclaimer.net -all
Cloud / SaaS Services Detected
Microsoft 365 Cisco Duo Proofpoint Essentials

Leak Screenshot:

Leak Screenshot