LEAK 22.10 SNATCH_CLOUD4 uploaded by a Telegram User

We noticed a significant influx of credentials associated with a specific cloud storage provider appearing on a dark web forum on October 22, 2021. The log file, uploaded by a Telegram user, contained a surprisingly high number of plaintext passwords alongside email addresses, which immediately raised concerns about the potential for widespread account compromise. What struck us was the direct correlation between the exposed credentials and API host information, suggesting a sophisticated attack vector targeting authenticated access rather than brute-force attempts. This particular dataset, originating from a stealer malware, points to a compromised endpoint as the initial vector, allowing for the exfiltration of sensitive user data.

The breach, identified as a stealer log from the "SNATCH_CLOUD4" campaign, exposed 17,867 records. Analysis of the uploaded file revealed a structured format containing email addresses, plaintext passwords, and associated URLs, specifically API endpoints for a cloud storage service. The presence of plaintext passwords is a critical vulnerability, enabling immediate unauthorized access. The inclusion of API host information further suggests that attackers were not only after user credentials but also aiming to leverage those credentials for programmatic access to cloud resources, potentially leading to data exfiltration or service manipulation. The source structure of the log indicates a single point of compromise, likely an endpoint infected with stealer malware, which then systematically collected and transmitted these credentials.

While this specific incident may not have garnered widespread mainstream news coverage, the broader trend of credential stuffing attacks and the increasing sophistication of stealer malware are well-documented in cybersecurity research. Organizations like Mandiant and CrowdStrike have consistently reported on the prevalence of stealer logs appearing on illicit marketplaces, highlighting the persistent threat posed by malware designed to harvest credentials from compromised endpoints. The SNATCH malware family, in particular, has been observed to target a variety of applications, including web browsers and cloud storage clients, making incidents like this a recurring concern within the threat landscape.