Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

branchgroup.com

branchgroup.com

Group Cactus
Discovered 2025-02-24 11:58 UTC
Est. attack date 2025-02-24
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

<p>Commercial &amp; Residential Construction.<br><br>“Founded in 1963, The Branch Group is a company that owns and operates different companies that specialize in civil construction, residential and commercial building construction, electrical and pipe installation, and more. The company is based in Roanoke, Virginia.”<br><br>Website: <a href="https://www.branchgroup.com/">https://www.branchgroup.com/</a><br><br>Revenue : $333M<br><br>Address: 442 Rutherford Ave NE, Roanoke, Virginia, 24016, United States<br><br>Phone Number: (540) 982-1678<br><br><mark class="marker-yellow"><strong>Download link #1:</strong></mark> <a href="https://[REDACTED].onion/BRANCHGROUP/PROOF/">https://[REDACTED].onion/BRANCHGROUP/PROOF/</a><br><br><mark class="marker-yellow"><strong>Mirror:</strong></mark> <a href="https://[REDACTED].onion/BRANCHGROUP/PROOF/">https://[REDACTED].onion/BRANCHGROUP/PROOF/</a><br><br><mark class="marker-yellow"><strong>DATA DESCRIPTIONS:</strong></mark> Personal identifiable information, Corporate confidential data, customer information, financial\payroll documents, Employees\executives personal data, IT department documents, corporate correspondence, etc.</p><p><img src="/uploads/Chris_Tucker_ID_22fbc5dcab.png" alt="Chris Tucker ID.png"><img src="/uploads/Branch_Sovos_NDA_07014a5eac.png" alt="Branch Sovos NDA.png"><img src="/uploads/Lori_Beth_Hoel_ID_5284d4273e.png" alt="Lori Beth Hoel ID.png"><img src="/uploads/Breeden_Heating_Air_LF_TPQ_2022_09_NDA_48b06d9916.png" alt="Breeden Heating Air - LF TPQ 2022.09 NDA.png"><img src="/uploads/Branch_interim_financial_statements_May_2023_c9b4b7e60d.png" alt="Branch interim financial statements May 2023.png"></p>

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • branchgroup-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • n6lrsdmkmp0jko6ajc9atnc33k
  • 5aghn8g2o00al3f0af5ouf58vf
  • bw=O1cmEgyWdQJg54yrDn7HRutVSooJthjmCqomYCOOqHlh
  • 31tuuelvap24r406h86a5jmhpu
  • hs77nitpgbdo8b158pbd224c4b
  • t5g66v98naqc4fo2d33s6aelet
  • google-site-verification=MW64bQV-MXxC_TmAxTWE192ewKMGDHDxiuZ465Qxp8A
  • dJFcY6hSIRqePtrBJt9hAtyl6mxwu6sr0s+7WECdFvRApxU+sBHAeQsVSwTgOIWxwVK7DL4ZhkBoIFEs6SnDfw==
  • v=spf1 include:dc-8e814c8572._spfm.branchgroup.com ~all
  • apple-domain-verification=QVjPXbuWuG6YVFjN
  • Required Data: include:8516163.spf03.hubspotemail.net Current Data: v=spf1 include:spf.protection.outlook.com include:_spf-sfdc.successfactors.com include:_spf-dc4.sapsf.com ~all
  • zoho-verification=zb63795209.zmverify.zoho.com
  • openai-domain-verification=dv-evJG68iPZG52Ku0esvAfqdWL
  • ciscocidomainverification=40620d711a874887e6985b14522373a376551ab86b9f6dba55a917a37ac416ab
  • 0ed1fe018a78199b8ec0d34035b1b3299956fa8641
  • o5qtfal6rjgj7ornbvbrfaq5t1
Cloud / SaaS Services Detected
Apple HubSpot OpenIA Zoho Campaigns

Leak Screenshot:

Leak Screenshot