The Monster Cloud Free 10 Breach Happened in November 2023. The Data Is Still Circulating Now.

We're seeing an uptick in stealer logs surfacing on Telegram channels, often containing credentials and API keys that can be leveraged for lateral movement within compromised organizations. What really struck us about this particular log wasn't the overall volume, but the specificity of the target: A collection of credentials seemingly related to a cloud file storage service, suggesting a focused effort to compromise accounts with privileged access to sensitive data. The data had been circulating quietly, but we noticed the potential blast radius given the types of accounts potentially exposed.

Monster Cloud Free: Stealer Log Exposes Credentials for File Storage Service

A stealer log, uploaded to Telegram in November 2023, exposed 4,291 records associated with Monster Cloud Free, a file storage service. The log file contained a mix of email addresses, plaintext passwords, and URLs pointing to potentially sensitive endpoints. The breach came to our attention as part of routine monitoring of Telegram channels known for hosting stealer logs. The presence of plaintext passwords is particularly concerning, given the ease with which they can be exploited. The fact that this data has surfaced on Telegram means it is readily available to malicious actors.

• Total records exposed: 4,291
• Types of data included: Email Addresses, Plaintext Passwords, URLs
• Sensitive content types: Potentially documents and files stored within Monster Cloud Free
• Source structure: Stealer log
• Leak location(s): Telegram
• Date of first appearance: 01-Nov-2023

Stealer logs are an increasingly common source of leaked credentials. As BleepingComputer reported earlier this year, stealer malware is often spread through phishing campaigns and malicious browser extensions, exfiltrating data directly from infected machines. This incident underscores the ongoing risk posed by stealer malware and the importance of robust endpoint security measures. The fact that the passwords were in plaintext also indicates a weakness in Monster Cloud Free's security practices. The broader threat theme here is the automation of credential harvesting and the ease with which these compromised credentials can be weaponized.