Niflheim 3.9 GB RATLOG by ComboPoster

We noticed a significant data leak surfaced on a prominent cybercrime forum around May 24, 2024, originating from a threat actor known as "ComboPoster." The dataset, advertised as "3.9 GB RATLOG ✨[UHQ] | GOOD FOR ALL | 500$ PAID LOGS," contained a substantial volume of user credentials and associated metadata. What struck us immediately was the sheer scale of the purported data, with an initial claim of 50 million records, though our analysis confirmed a unique pwned count of over 6.4 million. This incident highlights a persistent and concerning trend of credential stuffing and account compromise facilitated by readily available stealer logs.

The breach, identified as a database compromise, involved a stealer log that aggregated credentials and browsing data. While the specific source infrastructure for this log remains unconfirmed by the threat actor, the nature of the data suggests it was harvested by Remote Access Trojans (RATs) or infostealers deployed on compromised endpoints. The leaked information primarily consists of email addresses, corresponding homepage URLs, and critically, plaintext passwords. This combination presents a high risk for account takeover (ATO) attacks, especially if users have reused these credentials across multiple services. Our analysis indicates approximately 6,440,705 unique records were exposed, with the total dataset size reaching 3.9 GB.

While this particular leak from "ComboPoster" has not garnered widespread mainstream media attention, similar incidents involving the sale of credential dumps are a constant feature on dark web marketplaces. Security researchers frequently document the emergence of large-scale credential databases, often sourced from infostealer malware. For instance, numerous reports from firms like Mandiant and CrowdStrike have detailed the ongoing threat posed by RATs and the subsequent commodification of stolen credentials. The "Niflheim" moniker, if it refers to the origin of the compromised data, does not immediately correlate with any publicly known major enterprise breach, suggesting it may be an internal designation by the threat actor or a reference to a less publicized compromise.