How Attackers Used 29 SEPT SNATCH_CLOUD3 to Access 14,429 Accounts

We noticed a concerning upload on a public Telegram channel on October 1st, 2021, containing a stealer log file. What struck us about this particular incident was the direct exposure of endpoint credentials, specifically plaintext passwords, alongside associated email addresses and API host URLs. The sheer volume of records, while not massive in the grand scheme of enterprise breaches, presents a concentrated risk due to the nature of the compromised data. The rapid dissemination of such information via a public platform amplifies the immediate threat landscape for any entities whose users or systems were compromised.

The incident, dubbed "29 SEPT SNATCH_CLOUD3" by the uploading Telegram user, involved a single stealer log file that yielded 14,429 distinct records. Analysis of the data revealed a direct correlation between email addresses and their corresponding plaintext passwords, indicating a successful credential harvesting operation. Additionally, URLs pointing to API hosts were present, suggesting that attackers may have gained insight into the infrastructure or services targeted by the compromised endpoints. The source structure of the data points to a common credential stealer malware, likely deployed via phishing or malicious downloads, which then exfiltrated these sensitive details. The leak location was a public Telegram channel, offering no barrier to access for any interested party, thereby maximizing potential impact.

While this specific leak did not garner widespread mainstream news coverage, the underlying threat of credential stealer malware is a persistent and well-documented issue within the cybersecurity community. Research from various security firms, such as Mandiant and CrowdStrike, consistently highlights the prevalence of stealer logs appearing on dark web forums and public channels, often containing credentials that are subsequently reused across multiple platforms. The OSINT landscape for such leaks is vast, with numerous aggregators and forums dedicated to the trade and dissemination of compromised data, underscoring the need for proactive credential hygiene and monitoring.