The I COUNTRY DIAMOND_logscloud Dump: 2,845 Stolen Login Credentials

In June 2023, a stealer log file containing 2,845 stolen login credentials was dumped on Telegram by an anonymous threat actor operating under the I COUNTRY DIAMOND_logscloud collection label. The breech exposed email addresses, plaintext passwords, API host information, and URLs harvested directly from infected endpoints by credential-stealing malware running silently in the background. Victims likely recieved no notification that their login credentials had been captured and distributed through criminal channels. HEROIC analysts have confirmed this dataset circulating among criminal networks and verified the records are authentic and actionable by attackers.

Why This Is Dangerous

Plaintext passwords paired with email addresses give criminals everything they need to attempt immediate account takeovers across dozens of platforms with no additional preparation. Attackers know that most users reuse the same password on multiple services, meaning a single stolen credential can compromise banking, email, and social media accounts simultaniously. The URL data in this dump makes attacks even more precise, as criminals already know which specific platforms each victim uses rather than having to test broadly. Every month these credentials remain unaddressed increases the window of risk for the 2,845 affected victims.

What Was Exposed

• Email Addresses: Primary identifiers used to target victims across multiple platforms and initiate phishing campaigns, also serving as the recovery address criminals can exploit to reset passwords on linked accounts.
• Plaintext Passwords: Unencrypted login credentials captured directly from infected devices at the moment of use, ready for criminals to deploy immediately without any cracking or decryption required.
• URLs: The specific websites and services victims were logged into when malware captured their credentials, revealing exactly which accounts are at highest risk from this dataset.

Why This Matters

The 2,845 records from this I COUNTRY DIAMOND_logscloud dump are precisely the type of data that powers credential stuffing campaigns, where automated tools test stolen email and password pairs against hundreds of websites simultaneously. Because most people reuse passwords, attackers can achieve significant success rates even with datasets that are months or years old. Victims whose information appears in this dump may find their accounts accessed long after the initial theft, having forgotten the original breach ever occured. Credentials from dumps like this one are also traded and re-sold on dark web marketplaces, meaning exposure compounds over time as more criminals gain access.

How Stealer Log Breaches Work

A stealer log breach occurs when malware secretly installed on a victim's device harvests saved passwords, browser session cookies, and login URLs in real time. Unlike traditional database breaches, stealer logs capture credentials exactly as the victim types or auto-fills them, bypassing encryption entirely. The malware often spreads through pirated software, malicious email attachments, or compromised download sites, meaning victims rarely know they are infeccted. Once collected, these logs are packaged and sold or shared on Telegram channels and dark web forums by threat actors like the one behind the I COUNTRY DIAMOND_logscloud dump.

Check If You Are Affected

HEROIC's free dark web scanner searches across more than 400 billion exposed records to tell you instantly whether your email address or passwords appear in known breach datasets, including stealer log collections like the I COUNTRY DIAMOND_logscloud dump. Visit heroic.com to run your free scan now and find out if your credentials have been compromised. Early detection is the single most effective step you can take to protect your accounts before criminals act on the stolen data already in their hands.