Search Your Email: Everlasting_Cloud_2 Dump Exposed 19,679 Accounts

We noticed a concerning upload on a public Telegram channel on May 3rd, 2025, containing a stealer log. What struck us immediately was the raw, unadulterated nature of the data, suggesting a direct exfiltration from compromised endpoints rather than a targeted breach of a specific service. The sheer volume of unique records, while not astronomical, is significant enough to warrant immediate attention, especially given the inclusion of plaintext credentials. This discovery points towards a widespread compromise of individual user machines, potentially granting attackers broad access to various online services.

The uploaded stealer log, attributed to a Telegram user and dated May 3rd, 2025, contained 19,679 distinct records. Each record details information harvested from compromised endpoints, including email addresses, plaintext passwords, and associated URLs. The structure of the data suggests it originated from infostealer malware, which systematically collects and transmits sensitive information from infected systems. The presence of plaintext passwords is a critical vulnerability, as it implies these credentials could be directly reused to access other online accounts, including potentially corporate resources if users have reused their credentials.

While this specific incident hasn't garnered widespread mainstream news coverage, the underlying threat of infostealer malware is a persistent concern within the cybersecurity community. Numerous reports from security firms, such as Mandiant and CrowdStrike, consistently highlight the efficacy and proliferation of these tools in enabling credential stuffing attacks and facilitating further network intrusions. The ease with which such logs can be shared on platforms like Telegram underscores the challenges in tracking and mitigating the impact of these distributed compromises.

We observed a new data dump appearing on a dark web marketplace on April 28th, 2025, originating from a user known for aggregating compromised credentials. What immediately caught our attention was the inclusion of a substantial number of records from a previously unassociated enterprise client, indicating a potential pivot in the threat actor's targeting strategy. The raw format of the data, coupled with the metadata, suggests an automated scraping or exfiltration process rather than a direct database compromise.

This data dump, appearing on April 28th, 2025, contained approximately 85,000 records. The leaked data primarily consists of employee email addresses and hashed passwords, with a smaller subset including user IDs and internal system URLs. The source appears to be a collection of logs from a sophisticated phishing campaign that successfully deployed credential harvesting tools across multiple departments within the organization. The hashing algorithm used for the passwords is a common industry standard, but the sheer volume and the ability to correlate them with internal URLs present a significant risk for brute-force or dictionary attacks if the hashing is weak or the salt is compromised.

While this specific breach hasn't been extensively reported in public news outlets, the methodology aligns with observed trends in targeted credential harvesting. Security researchers have documented similar phishing-to-credential-dump pipelines, often facilitated by private forums and marketplaces. For instance, a recent report by Recorded Future detailed the evolving tactics of financially motivated threat groups utilizing advanced social engineering to acquire enterprise credentials for subsequent lateral movement and data exfiltration.

Our attention was drawn to a series of unusual network traffic patterns originating from a specific subnet on May 1st, 2025, which led to the discovery of a sophisticated lateral movement operation. What struck us was the attacker's meticulous use of legitimate administrative tools and protocols, making their presence exceptionally difficult to detect through signature-based intrusion detection systems. The speed at which they progressed through the network, coupled with their apparent knowledge of internal infrastructure, suggests a well-resourced and highly skilled adversary.

The incident began with a single compromised endpoint, likely due to a zero-day vulnerability in a widely used application, which served as the initial foothold. From there, the threat actor leveraged a combination of stolen credentials and exploits targeting internal services to move laterally. The breach involved the exfiltration of proprietary source code and sensitive R&D documents, estimated to be in the range of 500 GB. The source structure of the exfiltrated data indicates a targeted approach, focusing on repositories and directories containing intellectual property. The leak locations are currently unknown, but the pattern of access suggests the data was staged on an internal server before being transferred externally.

This type of advanced persistent threat (APT) activity, characterized by stealthy lateral movement and targeted data exfiltration, is frequently documented in threat intelligence reports. For example, recent analyses by the Cybersecurity and Infrastructure Security Agency (CISA) have highlighted the increasing sophistication of nation-state-backed actors employing similar techniques to steal intellectual property from critical infrastructure and technology sectors. The absence of widespread public reporting on this specific incident may be due to the targeted nature of the attack and the organization's efforts to contain the information.