Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Superloop ISP

superloop.com
Group Cyclops
Discovered 2023-07-14 19:55 UTC
Est. attack date 2023-07-08
Country AU
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Superloop is Australia’s modern challenger telco and internet service provider that’s unleashing the unlimited possibilities of the internet. Superloop is all about experience - we're not just a utility - with a promise to be super from the ground up. We’re more tech than telco, and we deliver quality service across our consumer, business, and wholesale units.Our can-do culture will excite and ignite our customers as we deploy game-changing solutions that solve customer pain points, backed by great customer service delivered by our highly enthused team of Superloopers, who are committed to making the internet experience super. Website: ======== https://superloop.com Data: ======= http://[REDACTED].onion/lift_me-6.zip PASSWORD:[REDACTED] http://[REDACTED].onion/zip file name-4.zip PASSWORD:[REDACTED] https://bayfiles.com/J4qdZ0x3za PASSWORD:[REDACTED] https://bayfiles.com/J4L6Y5x2zc PASSWORD:[REDACTED]
Infostealer activity detected by HudsonRock

Compromised Employees: 135

Compromised Users: 797

Third Party Employee Credentials: 45

External Attack Surface: 67

Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • mxb-00aa7201.gslb.pphosted.com. Proofpoint
  • mxa-00aa7201.gslb.pphosted.com. Proofpoint
TXT Records
  • docusign=fda6b9db-7cde-40ec-a561-536e55d98720
  • docusign=7118f7ae-a669-4eef-8f20-a81f3e5113c6
  • sprout-social-c77ad80e-74f8-48a5-987a-6195d9c0df2b
  • adobe-idp-site-verification=675cad51269101096f17bdf8e5843f4e68fd17e04f6ca3eb291396aef08d9808
  • anthropic-domain-verification-0j5rz3=qMvBfJx5GiVFHtMpIyPyG9cAA
  • jamf-site-verification=v_65pb-hVZ-Ep0NrRzpAdg
  • atlassian-domain-verification=z/1ocagxP5hZ34KFIZ3QPEz8TY3feCPCLvbxnIw216Zjrn9mkdxaVlk9vBrlUe92
  • paloaltonetworks-site-verification=390a7b417b47ff5ddb4b842d4c56c24212bddf80e10789a39d1f992f4af31d7f
  • orbitid-domain-verification=cksoz7s7n40443odmxxjnwmels:superloop.com
  • v=spf1 include:_spf.superloop.com include:servers.mcsv.net include:mail.zendesk.com include:sendgrid.net exists:%{i}._spf.mta.salesforce.com include:_netblocks.superloop.com include:amazonses.com include:spf-00aa7201.pphosted.com -all
  • Validity-Domain-Verification=jJJ3Sicv4fB/sfyQLAUQVoWMluA=
  • google-site-verification=QpgTxK_KD7s8M8-V5NWJ6BIeviPpGkPDC8MyXCL8AaU
  • Dynatrace-site-verification=deddeded-b9c9-4464-8f70-7971ba376759__ctc8g969np6sfglvm304ncps99
Cloud / SaaS Services Detected
Adobe Amazon SES/WorkMail Anthropic Atlassian DocuSign JamF Mailchimp Proofpoint SendGrid Zendesk

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.