Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Discovered 2026-04-08 15:57 UTC
Est. attack date 2026-03-05
Country KR
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Joycity is a prominent South Korean game developer and publisher founded in 1994 and listed on the KOSDAQ. Renowned for its innovation and global reach, the company originally pioneered the hip-hop-themed sports genre with its self-developed FreeStyle series, which became a cultural milestone for players across Asia. In the mobile era, Joycity successfully pivoted to the Strategy (SLG) genre, producing high-revenue titles like Gunship Battle: Total Warfare and Pirates of the Caribbean: Tides of War, with international markets consistently accounting for over 70% of its total revenue. Currently, Joycity is actively expanding into Web3 technologies and major cross-platform projects. Its blockbuster collaboration with Capcom and Aniplex, Resident Evil Survival Unit, has already surpassed 5 million global downloads as of early 2026, demonstrating the company’s robust R&D and operational expertise in managing world-class intellectual properties.

Infostealer activity detected by HudsonRock

Compromised Employees: 12

Compromised Users: 1174

Third Party Employee Credentials: 11


External Attack Surface: 106


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domainJOYCITY.CO.KR
  • domainjoycity.com
  • abuseinames.co.kr
MX Records
  • smtp.joycity.com.
  • joycity-com.mail.protection.outlook.com. Microsoft 365
  • mail.joycity.com.
TXT Records
  • MS=ms98667811
  • 03214ac4107a9f3141fb2557d68fbca5e41a2765a5614660ad4a874723dbcbba
  • amazonses:R9Pyc5b4ixBVGQ68roomqC2/SsbHIIwQ8aXA4YO8i2k=
  • 2thBLeGBH3SjRY7gTIeLbxpR6rhCwe71qG+zsukMYMUxSZqHIzIbBSc7DtqWtLrviG/brg68v/qMKG5mnzsUhw==
  • v=spf1 include:spf.protection.outlook.com include:amazonses.com include:spf.maillink.co.kr include:qcloudmail.com ip4:61.43.45.2 ip4:61.43.45.143 ip4:61.43.46.99 ip4:61.43.45.221 ip4:61.43.45.222 ip4:13.230.88.247 ip4:52.79.78.28 ~all
  • tiktok-developers-site-verification=GW38U5huICVabaEr8jn1xNeqX59NnXvW
  • google-site-verification=K9QMvVGv7Bj3S2Tnb2R-pFJlkn4PvGvcEq2BgKQu2D8
  • google-site-verification=WzLXLmgxRV7I4PJBcots-V-FUnDB1eVASR6tL5m19Yk
  • h9pAuOM1k8i4nuemkIxvfOR3keBjaG9XVnRXTo+9Qk+SYAa7e7XKPX3NtSSPViyiSWxpolUxcQ1ZKQpOSQ4AQQ==
  • google-site-verification=JV7AgG3RBXTpTggPrDGthbCXWiDPXr87EcwniLPJi-M
  • _globalsign-domain-verification=G4763G2CK8iRKJU_F4YR74IED_sTQEGMPejWXgXEs3
  • notion-domain-verification=e9Zrgczi670x3enc1ckE7fiMeqgUAhzUNyM8e3objuB
  • notion-domain-verification=5WZzPRszBhoA0Ves31RuSPuDyHALyYlnBfMPLGxgaFu
  • amazonses:ea/yEknwxDKHqWp2ezzVua/JhiWADuPjxlGi+CFpHx4=
  • _globalsign-domain-verification=Stb19Zz6H45je6kkRq6T6zfbx8dNK7J5IqiZtnwBJa
Cloud / SaaS Services Detected
Amazon SES/WorkMail Global Sign Microsoft 365 Notion

Leak Screenshot:

Leak Screenshot