Ransomware.live - Victim: Gerencial

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Gerencial

gerencialcontabil.com.br

Group Spacebears

Discovered 2026-06-17 05:59 UTC

Est. attack date 2026-05-21

Country

Description:

Gerencial Contábil (Gerencial PR) is a Brazilian accounting and business advisory firm based in the state of Paraná. The company provides accounting, tax, payroll, business consulting, and HR outsourcing services for small and medium-sized businesses. It also assists entrepreneurs with company formation, tax compliance, and business management.The firm operates through multiple offices across Paraná, including locations in Pato Branco, Francisco Beltrão, Dois Vizinhos, Cascavel, Guarapuava, and other cities. Its services are tailored to sectors such as commerce, industry, service providers, and non-profit organizations.-personal digital certificates (amount ~ 1 000) (.pfx / .p12 files) and the corresponding passwords for accessing the Brazilian official government websites. -Clients info (tel, mail, id, passwords, etc)-600 000 + files with personal information https://***.com.br/

Infostealer activity detected by HudsonRock

Compromised Employees: 2

Compromised Users: 0

Third Party Employee Credentials: 3

External Attack Surface: 2

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails

No emails found.

MX Records

_dc-mx.5fc1a2f328eb.gerencialcontabil.com.br.

TXT Records

v=spf1 ip4:200.71.78.35 include:spf.eaitelecom.com.br +a +mx ~all

Cloud / SaaS Services Detected

No well-known cloud or SaaS service detected.

Leak Screenshot:

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.