CLOUDHEAVENLOGS N-Country Pack Exposed 1,061 Stolen Credentials

On June 7, 2023, the CLOUDHEAVENLOGS operator released its N-Country pack -- one of at least fourteen geographic bundles distributed on the same day. The pack contained 137 individual stealer log files and exposed 1,061 compromised records, including email addresses, plaintext passwords, and the URLs of services where those credentials were recieved by infostealer malware. HEROIC's DarkHive intelligence system captured and indexed the full N-Country bundle as part of its continuous dark web monitoring operation.

Why This Is Dangerous

Stealer log packs like CLOUDHEAVENLOGS N-Country are not raw data dumps -- they are ready-to-use attack kits. Each of the 1,061 records includes the exact URL where the password was stolen, making credential stuffing and account takeover attacks immediately actionable. Because the passwords are in plaintext and the records are pre-sorted by geographic region, buyers can begin targetting specific banks, retailers, and services in the N-Country zone without any additional processing. The regional filter removes the noise that slows down attackers working with global dumps.

What Was Exposed

• Email Addresses: 1,061 email addresses harvested from infected devices in the N-Country geographic zone
• Plaintext Passwords: Unencrypted passwords captured directly from browser saved credential stores by infostealer malware
• URLs: Login pages and service endpoints showing exactly which accounts were compromised on each infected machine

Why This Matters

The CLOUDHEAVENLOGS June 7, 2023 release was not a single breach -- it was a coordinated multi-region distribution event covering at least fourteen geographic zones in a single calendar day. The N-Country bundle sits within a series that includes packs spanning from A-Country through at least N-Country, each representing a distinct region where infostealer campaigns were active. The aggegrated credential count across the full series runs into the tens of thousands, making it one of the larger same-day stealer log releases indexed by HEROIC's DarkHive system that month.

How Stealer Logs Work

Infostealer malware infects individual devices -- often through phishing emails, malicious downloads, or compromised software -- and silently extracts saved credentials from browsers, password managers, and applications. The stolen data is transmitted back to the operator's infrastructure, where it is sorted by geographic location metadata, packaged into country-coded bundles, and distributed via Telegram channels or dark web marketplaces. CLOUDHEAVENLOGS operates as the aggregation and packaging layer in this chain: collecting raw log output from affiliated malware campaigns and staging it for distribution. Each of the 137 log files in the N-Country pack represents one infected device's credential harvest.

Check If You Are Affected

HEROIC's free breach scanner covers more than 400 billion exposed records, including the CLOUDHEAVENLOGS N-Country 137PCS bundle and every regional pack from the June 7, 2023 distribution event. Enter your email address to instantly check whether your credentials appear in this pack or any other stealer log colection in the HEROIC database. The scan is completely free and takes seconds.