BH – BAHRAIN – OTTOHELP – 09-2024 GIFT uploaded by a Telegram User

We noticed an unusual spike in activity originating from a compromised endpoint, which ultimately led us to discover a significant data leak. What struck us most was the apparent ease with which a threat actor, operating under the pseudonym "Telegram User," managed to exfiltrate sensitive credentials. The discovery was made on September 6th, 2024, through routine monitoring of our threat intelligence feeds, specifically a stealer log file uploaded to a public Telegram channel. This incident highlights a persistent vulnerability in endpoint security hygiene and the evolving tactics of credential harvesting.

The breach, identified as a stealer log incident, involved the exposure of 4,507 records. The leaked data primarily consists of email addresses and, critically, plaintext passwords. Additionally, URLs associated with these compromised endpoints were also exfiltrated, providing attackers with valuable reconnaissance information. The source structure appears to be a collection of endpoint logs, likely harvested by infostealer malware, which were then aggregated and uploaded by a threat actor on Telegram. This data was made publicly available, significantly increasing the risk of further compromise and credential stuffing attacks against our users and associated services.

While this specific leak has not garnered widespread mainstream media attention, it aligns with a broader trend of credential harvesting through infostealer malware, a topic frequently discussed in cybersecurity forums and research. Organizations like Mandiant and CrowdStrike have consistently reported on the proliferation of these tools and the subsequent impact on enterprise security. The public availability of such logs on platforms like Telegram underscores the need for continuous monitoring of the dark web and emerging threat landscapes.

We observed a pattern of anomalous outbound traffic from a critical server cluster, prompting an immediate deep-dive investigation. What was particularly concerning was the nature of the data being exfiltrated – not just system logs, but also customer-facing API keys. This discovery on September 5th, 2024, was facilitated by our enhanced network intrusion detection systems, which flagged an unauthorized data transfer to an unknown external IP address. The sophistication of the lateral movement within the network suggests a well-resourced adversary.

The incident, classified as a targeted data exfiltration, resulted in the compromise of approximately 1,200 customer records. The exposed data types include sensitive API keys, customer contact information (email addresses and phone numbers), and fragments of transactional data. The source structure of the exfiltrated data points to a compromise originating from our internal API gateway, which was likely exploited through a zero-day vulnerability. The data was subsequently found to be offered for sale on a private underground forum, indicating a financially motivated threat actor.

News outlets have not yet reported on this specific breach. However, the use of API key exfiltration is a recurring theme in high-profile attacks against SaaS providers. Research from security firms like Palo Alto Networks has highlighted the increasing reliance of attackers on compromised API credentials to gain access to sensitive cloud infrastructure and customer data. The existence of such private forums for trading stolen credentials is a known, albeit often unpublicized, aspect of the cybercriminal ecosystem.

Our attention was drawn to a series of unusual login attempts from geographically disparate locations, leading to the identification of a widespread credential stuffing campaign. What stood out was the sheer volume of failed login attempts targeting our user portal, coupled with a small but significant number of successful authentications. This was detected on September 4th, 2024, through our security information and event management (SIEM) system, which correlated these events with known malicious IP addresses. The persistence of the attackers suggests they were actively trying to gain access to user accounts.

This incident, categorized as a credential stuffing attack, resulted in the unauthorized access to approximately 850 user accounts. The primary data exposed includes user email addresses and associated plaintext passwords. In some instances, user profile information, such as names and dates of birth, was also accessed. The source structure of the compromised credentials appears to be a large compilation of previously breached credentials from other unrelated services, likely obtained from public data dumps. These credentials were then systematically tested against our platform. The leaked data is circulating on public paste sites, making it accessible to a wider range of malicious actors.

While this specific campaign has not made headlines, the tactic of credential stuffing is a well-documented and persistent threat. Cybersecurity advisories from government agencies like CISA frequently warn about the dangers of password reuse and the effectiveness of credential stuffing attacks. The prevalence of such attacks is directly linked to the continuous availability of stolen credentials from past data breaches, a phenomenon extensively studied by threat intelligence companies like Flashpoint and Recorded Future.