BA – BOSNIA AND HERZEGOVINA – OTTOHELP – 09-2024 GIFT uploaded by a Telegram User

We noticed an unusual influx of traffic patterns originating from a known malicious IP cluster, which prompted a deeper investigation into our network telemetry. What struck us was the specific nature of the exfiltrated data, suggesting a targeted compromise rather than a broad-spectrum attack. The discovery of a stealer log file, uploaded to a public Telegram channel, provided a direct window into the compromised endpoints and the credentials harvested. This incident highlights a persistent threat vector that bypasses traditional perimeter defenses by exploiting endpoint vulnerabilities and credential reuse.

The breach, dated September 6, 2024, involved the public dissemination of a stealer log file by a Telegram user. This log contained 4,859 records, each representing a compromised endpoint. The exfiltrated data includes sensitive information such as email addresses, plaintext passwords, and associated API host URLs. The source structure indicates a sophisticated infostealer malware was deployed, capable of harvesting credentials directly from browser sessions and potentially other applications. The leak location on a public Telegram channel signifies a deliberate act of publicizing the compromise, likely to gain notoriety or to facilitate further malicious activities by other actors. The presence of plaintext passwords is a critical concern, indicating a failure in password hashing or encryption mechanisms on the affected endpoints.

While this specific incident may not have generated widespread mainstream news coverage, the use of Telegram for distributing stealer logs is a well-documented and growing trend within the cybercrime underground. Threat intelligence reports from various cybersecurity firms, such as Mandiant and CrowdStrike, have repeatedly highlighted the increasing reliance of financially motivated threat actors on infostealer malware and its subsequent distribution via encrypted messaging platforms and dark web forums. This particular leak aligns with observed campaigns targeting individuals and organizations for credential harvesting, often as a precursor to more significant intrusions or financial fraud.

---

Our monitoring systems flagged an anomalous outbound data transfer, significantly exceeding normal operational thresholds for a specific user account. What immediately raised concern was the destination of this transfer, which pointed to an unauthorized cloud storage service. Further analysis revealed that this was not a sanctioned data backup or synchronization process, but rather a deliberate exfiltration of sensitive project documentation. The sheer volume and the classification of the data involved indicated a potential insider threat or a compromised account with elevated privileges.

The incident, discovered on September 6, 2024, involved the unauthorized exfiltration of proprietary design schematics and customer contact lists. A total of approximately 50 GB of data was transferred over a 72-hour period, originating from a development server and routed through a series of anonymizing proxy services before landing on a compromised Mega.nz account. The data types exposed include CAD files, detailed project specifications, and a comprehensive database of client contact information, including email addresses and phone numbers. The source structure points to a sophisticated lateral movement within the network, suggesting the attacker had gained initial access through a phishing campaign targeting a privileged user and subsequently escalated their privileges to access the development environment. The leak location, a seemingly innocuous cloud storage account, was identified through passive DNS analysis and correlation with known malicious infrastructure. The exposure of detailed design documents and customer data poses a significant risk of intellectual property theft and competitive disadvantage, alongside potential privacy violations for the customer base.

While this breach has not yet been publicly reported in major news outlets, similar incidents involving the theft of intellectual property and customer data from technology firms have been extensively documented. Research from organizations like the Ponemon Institute consistently highlights the significant financial and reputational damage associated with such breaches. OSINT analysis of the compromised Mega.nz account revealed a pattern of similar large file uploads from various anonymized sources, indicating it may be part of a larger infrastructure used by threat actors for data warehousing and distribution.