Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

The Union League of Philadelphia

unionleague.org
Group Incransom
Discovered 2025-11-06 00:14 UTC
Est. attack date 2025-11-06
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Founded in 1862 as a patriotic society to support the Union and the policies of President Abraham Lincoln, The Union League of Philadelphia laid the philosophical foundation of other Union Leagues across a nation torn by civil war. The League has hosted U.S. presidents, heads of state, industrialists, entertainers and dignitaries from around the globe and has proudly supported the American military in each conflict since the Civil War. The Union League continues to be driven by its founding motto, Amor Patriae Ducit or Love of Country Leads.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 12

Third Party Employee Credentials: 0

External Attack Surface: 5

Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operationsweb.com
MX Records
  • mx2-us1.ppe-hosted.com. Proofpoint
  • mx1-us1.ppe-hosted.com. Proofpoint
TXT Records
  • v=spf1 a mx ip4:50.174.215.98 include:_spf.e2ma.net include:spf.protection.outlook.com include:mailgun.org include:spf.mandrillapp.com a:dispatch-us.ppe-hosted.com include:e2ma.net include:_spf.salesforce.com ip4:64.78.151.128/26 ip4:216.241.183.0/24 ~all
  • google-site-verification=CH1z-lLEEp0s9BAGacHOiWLBIeudfuBZ0s5Tw4dz4cM
  • mandrill_verify.lQwi8-IpRMaqKnMM_4g8kQ
  • google-site-verification=fMxDGC7qK4vFCsdhoNuqQvmrj5VjImoqTZEyAM7TLiY
  • ILqj8HYDJUu8xWtSjrRk/UlMBv4JkGUWrX1+GvSKz3LQfqC/o1AgggaN1SaS7jiigtHd718Ldh5iad6/KBgUyQ==
  • w0zq90d40cp157mh648mjgrjqzy0mwjr
  • e2ma-verification=xqagb
  • apple-domain-verification=bf24v23JB1nJlBNH
  • cb8d3fkqc24xpb1yr043nhwmbzfn52kr
Cloud / SaaS Services Detected
Apple Mailchimp Mailgun Mandrill Proofpoint Essentials Salesforce

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.