LeakBase 10M ULP by miamiv

We noticed a significant influx of stealer logs circulating on a prominent dark web forum on May 28, 2024. One particular log, identified as "Url:log:pass Fresh 5Gb," stood out due to its sheer volume and the direct accessibility of sensitive user credentials. What struck us was not just the quantity of compromised accounts, but the inclusion of plaintext passwords, a particularly egregious oversight that bypasses many common security layers. This discovery immediately flagged a high-priority incident requiring thorough analysis to understand the scope and potential impact on our user base.

The "LeakBase 10M ULP by miamiv" incident, as it's being referred to in underground circles, originated from a stealer log containing approximately 10 million records. Our analysis confirms that 4,772,775 unique email addresses were exposed, each paired with a plaintext password and, in many cases, a corresponding HomePage URL. This suggests a broad compromise, likely stemming from malware infections or credential stuffing attacks targeting less secure platforms. The raw, unencrypted nature of the passwords is a critical vulnerability, enabling immediate account takeover and further exploitation. The source structure appears to be a direct dump from compromised machines or web applications, highlighting a lack of robust data protection at the point of collection.

While specific news coverage on this particular "LeakBase 10M ULP by miamiv" dump is still nascent, similar large-scale credential leaks are a recurring theme in cybersecurity news. The tactic of distributing stealer logs on forums is a well-established method for threat actors to monetize stolen data. OSINT investigations into the forum where this log was posted reveal a consistent pattern of such disclosures, often linked to specific malware families or botnet operations. Researchers have previously documented the dangers of plaintext password storage, emphasizing its role in facilitating credential stuffing attacks and widespread account compromise across multiple services.

Our attention was drawn to a peculiar anomaly within a recent network intrusion detection alert on June 10, 2024, concerning unusual outbound traffic patterns from a legacy internal server. What struck us was the timing of this traffic, coinciding with a known zero-day exploit targeting a specific industrial control system (ICS) software suite. The persistence and exfiltration volume, while not immediately catastrophic, suggested a deliberate and targeted operation rather than a random scan. This discovery prompted an immediate deep dive into the server's logs and system integrity.

The breach, tentatively identified as originating from a compromise of the ICS server hosting the "SCADA-Control-v3.1.2" application, appears to have been facilitated by an unpatched vulnerability. Analysis of the outbound traffic logs indicates a sustained exfiltration of approximately 2.5 GB of data over a 72-hour period. The data types observed include configuration files, operational logs, and sensitive sensor readings, suggesting a reconnaissance and potential operational disruption motive. The source structure points to a direct compromise of the ICS server's operating system, bypassing standard network segmentation. The exfiltration route was masked through a series of compromised intermediary IoT devices, making initial detection challenging.

While this specific incident has not yet garnered widespread public media attention, the underlying ICS vulnerability is a known concern within the industrial cybersecurity community. Recent advisories from the ICS-CERT and research papers from firms like Dragos have highlighted the increasing threat landscape for operational technology environments. OSINT reveals discussions on private industrial control system forums about similar exploitation attempts targeting this specific software version, indicating a coordinated campaign by sophisticated actors.

We observed a sudden spike in failed login attempts across multiple customer-facing web applications on June 15, 2024, originating from a geographically diverse range of IP addresses. What struck us was the coordinated nature of these attempts, exhibiting a clear pattern of brute-force attacks targeting common credential combinations, but also demonstrating an ability to adapt to basic rate-limiting measures. The sheer volume and the persistence of these attacks, even after initial mitigation attempts, indicated a well-resourced and organized adversary.

This incident, dubbed "Project Chimera" by the threat actors based on intercepted communications, appears to be a large-scale credential stuffing operation. While no direct database breach has been identified on our end, the attack vector strongly suggests the use of compromised credential lists obtained from previous, unrelated data breaches. We estimate that over 500,000 unique user accounts were targeted in this campaign. The primary data types being sought are login credentials (username/email and password), with the ultimate goal of gaining unauthorized access to user accounts for potential financial fraud or identity theft. The source structure of the attack is a distributed network of compromised web servers acting as proxies, making attribution difficult.

While this specific campaign has not been widely reported, the methodology is consistent with numerous credential stuffing attacks that have been documented by security firms like Mandiant and CrowdStrike. OSINT analysis of dark web marketplaces reveals a steady trade in large lists of compromised credentials, often aggregated from past data breaches. The use of distributed proxy networks is a common tactic to evade detection and bypass IP-based blocking mechanisms, a technique frequently discussed in threat intelligence reports.