CRYPTONLOGS free pack uploaded by a Telegram User

We've been tracking a steady rise in stealer log packages circulating on Telegram channels, often advertised as "free" or "leaked" resources for aspiring cybercriminals. What really struck us wasn't the volume of these logs, but how quickly they were being weaponized and incorporated into automated attack chains. This particular package, dubbed CRYPTONLOGS, initially appeared to be just another collection of compromised credentials. However, the plaintext passwords and readily accessible API host information made it a particularly dangerous find, indicative of a broader trend of easily accessible resources lowering the barrier to entry for malicious actors.

CRYPTONLOGS Free Pack: 7,895 Records Fueling Credential Stuffing Attacks

In late December 2022, a user on Telegram uploaded a file labeled CRYPTONLOGS, which our team identified as a stealer log package. This package contained 7,895 records harvested from compromised endpoints. The data included not only email addresses and plaintext passwords, but also sensitive information like URLs and potentially internal API host addresses. This combination of data points is particularly valuable for attackers looking to conduct credential stuffing attacks or gain unauthorized access to internal systems.

The breach was discovered on December 31, 2022, when the file was posted on a public Telegram channel known for sharing leaked data. The presence of plaintext passwords immediately raised a red flag, as this greatly simplifies the process for attackers to exploit the compromised accounts. The inclusion of URLs and API host information suggests the stealer malware may have been targeting specific applications or services, potentially indicating a more sophisticated or targeted attack campaign.

This incident matters to enterprises because it highlights the ongoing threat posed by stealer malware and the ease with which compromised credentials can be acquired and used for malicious purposes. The availability of such data on platforms like Telegram underscores the need for robust endpoint security measures, strong password policies (despite the presence of plaintext credentials in this case indicating a failure of those policies at the source), and vigilant monitoring of potential credential stuffing attacks. The incident also ties into the broader threat theme of automated attacks, where readily available tools and data are used to rapidly exploit compromised credentials across multiple platforms.

• Total records exposed: 7,895
• Types of data included: Email Addresses, Plaintext Passwords, URLs, API Host Addresses
• Sensitive content types: Potentially internal application URLs and API access points
• Source structure: Stealer Log (format varies depending on the stealer family)
• Leak location(s): Telegram channel
• Date of first appearance: December 31, 2022

The incident aligns with reporting on the increasing prevalence of stealer logs being traded on Telegram and dark web forums. Security researchers have documented the use of various stealer families, such as RedLine Stealer and Vidar, to harvest credentials and other sensitive data from compromised systems. These logs are then often sold or shared on underground platforms, providing attackers with a readily available source of compromised data. One Telegram post claimed that these logs are particularly useful for bypassing multi-factor authentication (MFA) in certain cases where session cookies are also stolen. This underscores the need for organizations to implement robust MFA solutions and monitor for suspicious activity on their networks.