Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

universalplant.com

universalplant.com

Group Chaos
Discovered 2026-06-30 16:54 UTC
Est. attack date 2026-06-30
Country US

Description:

FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive contains highly sensitive information, including: Financial & Accounting: Full audits, tax filings (ADP), payroll, bank transa…

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 13

Third Party Employee Credentials: 2


External Attack Surface: 2


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • ra4en9f73rvnetworksolutionsprivateregistration.com
  • domain.operationsweb.com
MX Records
  • universalplant-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • kgebq5cneuj8ccqjkigksvv1ir
  • openai-domain-verification=dv-ncE6oVZgcw3auzhp8dazNCio
  • vol4dbikhr36iqm06ksc9b60mk
  • dmlld3BvaW50X2F6dXJlX2NvbW1vbg==
  • 6l5enremufndb8r5hsbkogdkoe
  • nintex.661fcff6227161a979186e02
  • fa5677d5-efe7-4679-9419-9150312d56f8
  • a7mr1epp6dfk43oij89f8rq4q3
  • 0ed1fe018a6e6c41c913354fe9b0505b7934e3acfc
  • naaqq7rtpdasc8u2754gi1d0ej
  • apple-domain-verification=7Vr6nJkjjUUQcKoo
  • amazonses:KhBRzayYj+EQIh2wJFoM60MeypUfxwRDuN6GFIUyhxw=
  • jkk8gvdn1ug53bo2nforg9n059
  • 28a62e4a-b20c-4e95-83ec-cfa3f0005283
  • 2pv0gipqk6lskhlo5n3qqhqbgh
  • r3u28tariagcpjj370jdgh6ofv
  • 408ieer6jtolicne76b2ggpmlt
  • v=spf1 include:us._netblocks.mimecast.com include:spf.protection.outlook.com include:_spf.salesforce.com ~all
  • dW5pdmVyc2FscGxhbnQ=
  • 4kkkh070hi8btns5327s2558l9
  • blpq9jr9bmvb703sb8es1sbt7s
  • nintex.618bf19a5598b50069552da2
Cloud / SaaS Services Detected
Amazon SES/WorkMail Apple Mimecast OpenIA Salesforce

Leak Screenshot:

Leak Screenshot