Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Anglo American plc

angloamerican.com
Group Arkana
Discovered 2025-05-21 17:50 UTC
Est. attack date 2025-05-21
Country GB
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[AI generated] Anglo American plc is a multinational mining corporation based in Johannesburg, South Africa and London, UK. It is the world's largest platinum and diamond producer, with operations in more than 40 countries. Besides platinum and diamonds, it mines copper, nickel, iron ore, metallurgical and thermal coal. Founded in 1917, it is one of the world's top mining and natural resource companies.
Infostealer activity detected by HudsonRock

Compromised Employees: 124

Compromised Users: 159

Third Party Employee Credentials: 441

External Attack Surface: 93

Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abuselexsynergy.com
MX Records
  • za-smtp-inbound-2.mimecast.co.za.
  • za-smtp-inbound-1.mimecast.co.za.
TXT Records
  • google-gws-recovery-domain-verification=56541847
  • astro-domain-verification=cmejqt4w20afx01l51ocm854h
  • dtm-domain-verification=Uiu6V9AkCjLpYz82jMUwBXsd7PzgWzq__NAdjTpFb3o
  • adobe-idp-site-verification=d9a36a93fe71a3a9aa8eba01a724b3e78b250773a99477cb72fba996df8d0e0e
  • asv=0bb8f9926777d62179c4bb34fea20d6a
  • +zbyA9o8tag/032D/x33Gbplg7U9Hm8xomplQSSZ/5s=
  • autodesk-domain-verification=MH9PmrJfp0l4DBjgYoJG
  • atlassian-domain-verification=siZ1uOON8GI5RLB4fy2z0ilSZQrsQXTdcAiH0vySxE5A8WdFRVvpV6EXvTqIsQM8
  • _globalsign-domain-verification=eY66kPnBiSHa5RLQXayvccN-pQINBFplAOoAh1kfyK
  • Z2Zt/tZBlIlpuEwX1K04muTuWzBZfNiYS1vz1uXPXAs=
  • miro-verification=9ef9c4534a25269aa4df6c4e5a8e489cec42a0d1
  • smartsheet-site-validation=I2QlhqKY-QDzXQLKyDQOVKqRd9DkVuIC
  • 1password-site-verification=7HEXHXQKIFDU3ANPLCADOHT73Q
  • qhPyNfFaS05fAScUIxkN3ZMcff3FuN/rPOLU9H+RNqA=
  • docusign=5a7213bb-0615-44ec-ba2d-3a21e8308bb7
  • canva-site-verification=7rbd_fRrydkSrSBDNFJEtA
  • google-site-verification=NmVXYhNaKQGHu0qentVtibTG5rsHnKLsarDvWlDiJJ0
  • asv=d60013ef54da1c8cd7b92c5e74aefb93
  • 00D20000000oqNn=1TBP600000000eL
  • flexera-domain-verification-zbofrhegmkufyhgt
  • v=spf1 ip4:41.74.192.0/20 ip4:169.50.108.34 ip4:5.61.115.80/28 ip4:5.61.115.112/28 ip4:5.61.115.96/28 ip4:196.50.108.34/28 ip4:203.41.57.144/30 ip4:203.38.232.46 ip4:76.223.133.25 ip4:76.223.133.26 ip4:98.97.248.0/21 ip4:139.60.152.0/22 ip4:216.221.161.14" " ip4:216.221.161.15 include:za._netblocks.mimecast.com include:eu._netblocks.mimecast.com include:nw010.com include:nw011.com include:nw001.com include:_spf.qualtrics.com include:_spf.vivantio.com" " include:_spf.salesforce.com include:_spf-dc33.sapsf.eu -all
  • _globalsign-domain-verification=Xb8mL_141Rtph-TlOtOFWsDSp1Hczq-d0KLc3lvxml
  • apple-domain-verification=gJlV79nQEBXxB29H
  • openai-domain-verification=dv-4w8UAIqHSXcuaUs6c3CtiWjw
  • twilio-domain-verification=53976f1c552567e643b397e1b84e60a1
  • atlassian-domain-verification=sPtxylF9sYh3s5Ml1KaEsCSh0plLJL6+jfPCYXLLnH0MSX3Zdni2nA6EIQaKDiLn
Cloud / SaaS Services Detected
1Password Adobe Apple Atlassian Autodesk Canva DocuSign Flexera Global Sign Mimecast Miro OpenIA Salesforce Smartsheet Stripe Twilio

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.