Finding CF-2991
Low exposure on hr.meridianenergy.example
Mark in progressFalse positive
LowCompleted
EmployeeDetected 2026-07-09 19:45Seen 1× across sourcesCredential evidence
Passwords are masked — full values require reveal permission- Identity
- [email protected]
- Login URL
- https://hr.meridianenergy.example/self-service
- Password
- Jq5••••••••••
- Matched asset
- hr.meridianenergy.example
- First seen in log
- 2026-07-06
Infected device
- Device
- WIN-D2K4P7X
- Operating system
- Windows 10 Pro 22H2
- IP at capture
- 198.51.100.90
- Country
- Brazil
- Infected at
- 2026-07-06 18:10
- Antivirus
- Not detected in log
Source block
- Block
- BLK-88310
- Stealer family
- RedLine
- Posted
- 2026-07-06 12:41
- Channel
- Telegram cloud-of-logs
- Lines in block
- 2,330
Related findings
Triage timeline
2026-07-09 19:45 · System
Finding created from stealer block and matched to asset hr.meridianenergy.example
2026-07-09 19:45 · System
Severity set to Low based on asset criticality and credential context
2026-07-09 09:30 · A. Analyst
Status changed to Completed
Awaiting next analyst action