453,423 Records Leaked From the Nullcyber Cloud ULP Dump

Nullcyber Cloud ULP Surfaces in a Private Upload

A file labeled ULP_Private_14258541_011125_040312_Nullcyber_Cloud made its way onto Telegram on November 1, 2025, carrying 453,423 login records inside it. The clunky, technical filename is typical of how these logs get passed around behind the scenes before anyone outside the group ever sees them.

Why This Is Dangerous

ULP files, short for username, login, password, are built specifically to be plugged straight into credential stuffing tools. That means the data doesn't need to be cleaned up or reformatted, it works right out of the box accross dozens of automated login attempts per second. Every one of the 453,423 people in this file is a potential target the moment it starts circulating.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs
• 453,423 total records exposed

Why This Matters

Because this data is plaintext and already organized by site, attackers don't need to do any extra, neccessary prep work before using it. They can simply sort by URL and go straight after banking logins, email accounts, or shopping profiles, whichever looks most valuable. Anyone whose information landed in this file should treat every password tied to it as already compromised.

How Stealer Logs Work

This kind of file comes together after malware infects a batch of devices and quietly harvests saved credentials from each one. The person running the malware operation, sometimes going by a name like Nullcyber Cloud, then compiles everything into one organized ULP file and distributes it privately before it eventually leaks more broadly, as this one has.

Check If You Are Affected

You shouldn't have to wonder whether your login ended up in a file like this one. HEROIC's free breach scanner checks your email against a database of over 400 billion leaked records, giving you a clear answer in seconds so you can change any exposed password right away.