AE-UAE-OTTOMANCLOUD: 1,043 Stolen Credentials Now on the Dark Web

We observed a concerning upload on February 2nd, 2023, by a Telegram user, identified as "AE-UNITED ARAB EMIRATES-63PCS-2022-OTTOMANCLOUD." This file, a stealer log, contained a significant volume of compromised endpoint data. What struck us as particularly noteworthy was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs. This type of data aggregation from a stealer log suggests a sophisticated, albeit opportunistic, compromise that bypasses typical credential stuffing defenses.

The "AE-UNITED ARAB EMIRATES-63PCS-2022-OTTOMANCLOUD" incident, discovered on February 2nd, 2023, represents a direct exfiltration of 1043 records through a stealer malware. The log file, uploaded by an anonymous Telegram user, details compromised endpoints, revealing email addresses, plaintext passwords, and the corresponding API host URLs. This direct exposure of credentials, rather than hashed or encrypted forms, significantly lowers the barrier to entry for further exploitation. The threat theme here is clearly credential harvesting and subsequent infrastructure mapping, enabling attackers to potentially pivot into other systems or services associated with these compromised accounts. The source structure is a raw stealer log, indicating a direct capture of user input or session data.

While no immediate widespread news coverage or extensive OSINT reports are linked to this specific Telegram upload, the nature of stealer logs is a persistent and evolving threat. Research from cybersecurity firms like Mandiant and CrowdStrike consistently highlights the proliferation of infostealers and their role in initial access for more complex attacks. These tools are readily available on dark web forums and are often used by financially motivated actors to gather credentials for a variety of services, including enterprise VPNs, cloud platforms, and email accounts. The presence of API host URLs alongside credentials suggests a potential focus on programmatic access, which could be leveraged for automated attacks or data exfiltration from connected services.