298 PCS – 31.12.2022 CLOUDCOSMIC uploaded by a Telegram User

We've been tracking an uptick in stealer logs appearing on Telegram channels frequented by initial access brokers. What really struck us about this particular log wasn't the volume, but the apparent targeting of cloud infrastructure credentials and internal URLs. The setup here felt different because it wasn't the typical grab-bag of user accounts; the focus on API hosts and internal documentation suggested a more deliberate campaign aimed at compromising a specific organization's cloud environment. The data had been circulating for several months, but we noticed a spike in chatter around it recently, prompting a deeper dive.

CloudCosmic Stealer Log: 6,439 Records Exposing Cloud Infrastructure Details

In early January 2023, a 6,439-record stealer log file was uploaded to Telegram, originating from a compromised endpoint on December 31, 2022. What caught our attention was the targeted nature of the exposed data. While stealer logs often contain a mix of personal and professional credentials, this one was heavily skewed towards internal URLs, API host addresses, and plaintext passwords likely used for accessing cloud-based resources. This suggests the compromised user had access to sensitive internal systems and documentation. The file was named "298 PCS - 31.12.2022 CLOUDCOSMIC."

The breach was discovered on January 1, 2023, after being shared on a Telegram channel known for hosting and trading compromised data. The structure of the log file, while typical for stealer logs, contained an unusually high concentration of information related to cloud infrastructure. This matters to enterprises now because it highlights the ongoing threat of targeted credential theft aimed at cloud environments. Attackers are increasingly using stealer logs to gain initial access to sensitive systems, and this breach demonstrates the potential impact of even a single compromised endpoint.

• Total records exposed: 6,439
• Types of data included: Email Addresses, Plaintext Passwords, URLs, API Host Addresses
• Sensitive content types: Internal documentation URLs, potentially sensitive API endpoints
• Source structure: Stealer log file
• Leak location(s): Telegram channel
• Date of first appearance: January 1, 2023

The appearance of stealer logs on Telegram channels is a well-documented phenomenon. Security researchers have observed a growing trend of initial access brokers using these platforms to buy, sell, and share compromised credentials. As reported by BleepingComputer, many of these logs are generated by malware such as RedLine Stealer, Vidar, and Raccoon Stealer, which are readily available on the dark web. The CloudCosmic stealer log aligns with this trend, highlighting the ease with which attackers can obtain and distribute sensitive data.