Search Your Email: The Nullcyber_Cloud ULP Dump Exposed 3.8 Million Accounts

HEROIC analysts identified a massive stealer log uploaded to Telegram in October 2025 under the file name ULP_Private_7347956_011025_081259_Nullcyber_Cloud. The dump contains 3,853,499 records including email addresses, plaintext passwords, and the URLs of targeted services. Distributed through the Nullcyber_Cloud Telegram channel, this credential list represents one of the larger private stealer log releases HEROIC has catalogued, giving anyone who downloaded it immediate access to millions of account login pairs.

Why the Nullcyber_Cloud Stealer Log Is a Major Threat

With nearly 3.9 million records exposed in plaintext, this dump is large enough to enable large-scale automated attack campaigns. Credential stuffing tools can cycle through millions of email and password combinations in hours, testing them against hundreds of popular services simultaneously. Because the file also includes the URLs of the services the credentials belong to, attackers already know which accounts to target -- no guesswork is required. The scale of this dump means the statistical probability of your email appearing in it is significantly higher than in smaller stealer log releases.

What Data Was Exposed in the Nullcyber_Cloud ULP Dump

• Email Addresses -- Millions of active email accounts usable as usernames across hundreds of services
• Plaintext Passwords -- Unencrypted passwords extracted directly from browser credential stores, requiring no additional cracking
• URLs -- The specific login pages and web services associated with each stolen credential pair, allowing precice targeted attacks

How Attackers Weaponize a 3.8 Million Record Stealer Log

• Credential stuffing -- Automated bots test all 3.8 million email/password pairs against popular services including banks, streaming platforms, and retailers
• Account takeover -- Successfully authenticated accounts are immediately harvested for stored payment methods, personal data, and linked services
• Identity theft -- Email account access exposes years of personal correspondence, tax documents, and idntification data
• Financial fraud -- Compromised accounts are used to initiate fraudulent transactions, redirect deposits, and drain stored balances

What Is a ULP File and How Does This Type of Stealer Log Work

ULP stands for URL:Login:Password -- a structured credential file format commonly produced by stealer malware and used in underground markets. Each line contains a service URL, the email or username, and the associated plaintext password. The Nullcyber_Cloud naming convention indicates this file was compiled and distributed by a specific threat actor or Telegram channel operator. Stealer malware instaled on victims' devices harvests saved browser credentials, session tokens, and login autofill data, then transmits everything to a remote collection server. The operator packages these into ULP-format files and distributes them through private Telegram channels, often monetizing access through subscriptions or one-time sales. This October 2025 release of nearly 3.9 million records is a direct product of that pipeline.

Search Your Email in the Nullcyber_Cloud Dump -- Free at HEROIC

With 3,853,499 records in this single file, the odds that your credentials appear here are meaningful. HEROIC's free breach scanner checks your email against this dump and more than 400 billion other compromised records instantly. If your email appears in the Nullcyber_Cloud ULP or any other breach, you will receive an immediate alert. Search at HEROIC.com right now -- it is completely free and takes less than 10 seconds.