The Everlasting_Cloud Breach Put 8,513 Stolen Credentials Online

We noticed an unusual spike in outbound traffic from a segment of our network that typically exhibits low activity. This anomaly, first detected on April 28th, 2025, led us to investigate a compromised endpoint. What struck us was the apparent sophistication of the initial access vector, which bypassed several layers of our perimeter defenses before establishing a persistent connection. The subsequent discovery of a stealer log file, uploaded by an anonymous Telegram user, revealed the extent of the compromise and the nature of the exfiltrated data. This incident highlights a concerning trend in the exploitation of endpoint vulnerabilities for credential harvesting.

The breach originated from a compromised endpoint, identified as part of the 'Everlasting_Cloud' infrastructure. A stealer log file, uploaded to a public Telegram channel by a user identified only as 'Telegram User', contained 8,513 records. These records primarily consist of email addresses and associated plaintext passwords, along with URLs pointing to the compromised API hosts. The data structure suggests a direct capture of credentials and session information from the affected endpoint. The significance of this breach lies in the direct exposure of user credentials, which could facilitate further lateral movement within our environment or be used for account takeovers on other services that reuse these credentials. The presence of API host URLs further indicates the potential for attackers to pivot and exploit other connected services.

While specific news coverage for this particular incident is limited, the methodology employed aligns with broader trends in credential stuffing and account compromise facilitated by readily available stealer malware. Research from cybersecurity firms like Mandiant and CrowdStrike has consistently highlighted the proliferation of such malware on underground forums and messaging platforms, enabling less sophisticated actors to conduct targeted attacks. The ease with which these logs are shared on platforms like Telegram underscores the persistent threat posed by data breaches and the subsequent weaponization of stolen credentials.