Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

piramal.com

piramal.com

Discovered 2023-03-27 23:06 UTC
Est. attack date 2023-03-27
Country IN

Description:

The Piramal Group is an Indian multinational conglomerate that has presence across various sectors such as healthcare, life sciences, drug discovery, financial services, alternative investment and real estate

Infostealer activity detected by HudsonRock

Compromised Employees: 128

Compromised Users: 103

Third Party Employee Credentials: 130


External Attack Surface: 81


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuse-contactpublicdomainregistry.com
  • ashish.kawatrapiramal.com
MX Records
  • cluster1.us.messagelabs.com.
  • cluster1a.us.messagelabs.com.
TXT Records
  • _7d4thy7ry2tmk2y51j71donc2wtyyh1
  • _4ubelil44iz3rdxztuk27jn2gdhki0h
  • _0ln8mme0yqrz6x8itvu0x6dg32cys93
  • _6g6jh8sz5hqr67ex9eb86f2rlxvs1zi
  • _1y0owveiq1qg8ey3bohriwbal015jzh
  • 1q8lr7gmvyckyhppc2kcwfzyhjr6pqff
  • docusign=3099f58d-8dd3-43d3-a4e2-45c0ae5ad287
  • _lyh6bmn6rki617kcvtyaoneuqd2vvol
  • _hccwclhgt8pqzsgy27012ruzayu5fuc
  • globalsign-domain-verification=an3MgatcVdhb2wOnSyZ_P-KnmWz0vPfx_WzJhS44BV
  • _td1v7tmdhga12syzbl4t4qscuuex9fl
  • _i5c1lr4yjj2nxyusnp7q5mmiq5stlr9
  • docusign=957e5152-f188-4cc4-9876-698ab8915563
  • _fxifsckohcgryvmt96pa1u5ro3b0lmo
  • 571mpvccxhgbf1r6tykb0whd8wtry1kr
  • _waww03f3ntrkd645e1x7if81akxd54z
  • _smtmzw4dh1k056hcykh3yupdslnq9re
  • _2zzelgeof3ln06iw1q56bogs8xu2ske
  • _zt6mzy98atb6rwl9bz3k9wz01b6ftbv
  • _lrlo1mqguilm2zk2vdoumvqmgas20vz
  • glw1nnk4b0hc6ks03wg6lyq7xmrzp2pk
  • sga1nmah7j904tbkh583bq5qsv
  • ngczzdvzpvlgnpz1r385gh9y6mvhdwjs
  • stagingnewpiramalsite.azurewebsites.net
  • _uwxlt8gi9mt3whsgf7etvp6a26hig02
  • _av9hu153gq98kpyxqg92t6wexc2wunf
  • _bwumtlm5innnr09q0q0k81fwl7uo415
  • _2nbw4zjc5zu8egc1k3eggdaidxq4u62
  • _byglksxoof3araoyado6kcvm2m234js
  • YJgbltn+c1A6YSvaW72CENyUUgtrkHVO7WijXGP4G0w=
  • _9kxa273t61c5682lzftq58m3l6i5row
  • _fs9z4jntzeprvum4sahp3kkqulf1ft8
  • _vqnbx513ffcqcmtdbdyn0qz0qnx812y
  • _10s25em77syodzku1nk9h6p36u2q7jz
  • xlk66xwc2fy1cdyjgvhby7lx6sqpcmpr
  • google-gws-recovery-domain-verification=60621655
  • mongodb-site-verification=e3r849tIqpqrfHcQ4s3FwupABOCozhCt
  • _642iccm1rqnued6a90qkgr9jes0abof
  • _knw92q4l7h09j6gh04g1ill4jn4vj7y
  • _3sa45tykjhsgsbe7awdja7lphz0eoro
  • atlassian-domain-verification=aKpzvDlyeXZ0qbBzCG6aaTsyw6jjwMmpViFExa93CREifwWLizff67bilazjDmyD
  • _b9qlpq417zx3io068304f6t91grg45m
  • _a3oleok44g4vsrdbkyo2lwzabenltza
  • _1bl11nq51to3rxdqlncimulm8h1mptf
  • _jn0p8d3l1uqmlirxv41w42gsol67wzv
  • _hgnnly1sf5uxfvuvrza529m2ji4ou7e
  • 9bgr2l9qcgckzmvks1c4ywq9cs1xlhvwqnkwywzptq4n7xwdg35xkvhflmr4sqpm
  • _t7l5rexd54v57wdlham6mbjc4kykd5v
  • _zhnlbltlt65zd3nlkzsnasm2b9vo61p
  • npts6juinsaqqnj6d2us157fel
  • _tohzdv8v3f5d82u430xlu1031n0c4hw
  • _l1xmhce9qm8qn3nt4kuqkhyp1q0v29w
  • +CYZ+V/+G18f7+tldkuxMCuCfJso1pNUy6OPjgD0Fmegcc9mMADjnT0nzh2219J5vSH2BGLOWlsopJZK6Q+Sfw==
  • hdntlj07cccha8jqb8ugipecj0
  • _qqt712hd97yqsewwfja7sslpdhwthxp
  • _l3z4xn3pppx8q76ral5fki99ov0yarz
  • sign-in-app-verification=FYyQqrZ93ZMys9JV2PCt9jc0VHGB9kERoNtWe2rj-jQ
  • _87f9j7amaqfqq5rzksze8a98ikt12e3
  • _db7flys7izryyvcomeqhu56p0evubsj
  • _9iinfm6zi2jxq434h5vvaj3dwcgj7sw
  • _b5i7eynkta6ixni1cbcbgvvm6ij1w87
  • _w6zgjjwuft6ouhb2rqz6yfe6ozamkl0
  • _j7q9nyh4oilhnvmiovgi0o3hfkpytg9
  • _pxgjgz58ukpwo03alzae93anpjwcn4e
  • _4v2i1v91bnupd1pnxovtql5cz56st3j
  • _tp4o7300yivst0ehkn4h5jx49duzlgw
  • _l9i27lgex5799h515itpnucx233j6uc
  • _cagyheejdptsifkq06t4rqi611p8hcd
  • _v9i8wrl24v87v26zv06j7mopnkdg3lz
  • _bho896xzflc07b6gbilqx33r7equwz9
  • globalsign-domain-verification=xSS80HfXGjKp8QQHW1CQtC-HabvJNkzyi-LrHWmgVr
  • docusign=47e7f898-1143-4df0-86c1-9612bf4a9517
  • _igvndez95vley5kgjf5hof0b3gu7rjb
  • 7jr8yd81qyfnkc77h734yqygmzv55ps0
  • google-site-verification=XEghAahSCkWv3QXMCBFEmCAVEjvbU--gKJr23YsqNAU
  • _85jnkjtkqf3r7ba89bpakmptxxzk1ga
  • Dynatrace-site-verification=8566a7bb-11f7-461d-860f-dfdef38ac68f__c1j1ij56gm77031g4ab1k4a4nq
  • MS=ms26521648
  • _s3qaq4iou0ha29hskzj8hvd13sel5sy
  • AA4549E851FAF76266402943D8BD96F2967FB2D7ECBA67C419EAB1D51503381D
  • _3el6rgllcw9ld0r2doxj6ief3e782rf
  • _1xqj0eozm1md4v2jz52esekt5zzmnvo
  • MS=ms88740911
  • d8MT+DM7UOp1DnMXXHIA3muVted4tj0hujBVl57JIi8=
  • _efau1cjq4akcx2zqkkxjq6im17ycub8
  • MxQB2j4f46P0JE1GvoeN4/60qo7lgHqkN3WAr89PQXQ=
  • amazonses:q4UTCg7lOYVnGLhnA3QdMvsfGoQBCDwQd7VsJ1MzVho=
  • _efhisfndxo2dexpa4gddk3fc89l2qa3
  • _hwkm5qgeldqrznbuzdsctmdnd92xafn
  • _fl31jtrwcjvmipunkws0fdg6fhxzfjj
  • _7d4thy7ry2tmk2y51j71donc2wtyyh1
  • _zvgq07fmu5jcjf5qdpwg6vog6qht3pz
  • _fwlvyvcx4njt218zof69r9voi48xlm2
  • box-domain-verification=da206667aec126d2cb8cbc48e409ab3f18b1763146b0fac29eeff50aec65ce99
  • _7f4r6shhzydut5eec46nq84b0snqap8
  • _68k1kyh3vvw5yvemv5fmiavbmua3x18
  • mongodb-site-verification=XL2399xzwNnq10noWvMAkPqwxkQgCJTr
  • _ii0onc1157qcgpbrvwxmfu9447s5r1m_j6osp7m97228u6nnundrv74p0yuixw1
  • google-site-verification=DRhZMn0eV_RMUkqsjEi1g$S668vK@VStgJDx86uWTAc
  • v=spf1 ip4:180.179.157.242 ip4:49.248.213.236 ip4:122.187.208.12 ip4:122.187.208.13 ip4:49.248.213.238 include:spf.messagelabs.com include:_spf.salesforce.com -all
  • _7edav9g624wk17nzkk3o249rguwcet7
  • docusign=448338bd-1868-466d-b43d-33d01ea836b3
Cloud / SaaS Services Detected
Atlassian Amazon SES/WorkMail Microsoft 365 Salesforce Box DocuSign

Leak Screenshot:

Leak Screenshot