Identity Theft Just Got Easier Because of the NullCyber Cloud Breach: 98,836 at Risk

HEROIC analysts documented a large stealer log file uploaded to Telegram in November 2025 under the filename ULP_Private_2457729_101125_140032_Nullcyber_Cloud. The file exposed 98,836 records in a URL:Login:Password format, meaning each entry paired an exact website address with the email and plaintext password used to log in there. The Nullcyber label indicates this file originated from the NullCyber criminal infrastructure, a known Telegram-based operation that harvests and distributes stolen credentials. At nearly 100,000 records, this is a substantial exposure with real consequences for victims across dozens of online services.

Why the NullCyber Cloud ULP Format Makes This Breach Worse

A standard credential dump just lists emails and passwords. The ULP format in this file goes further -- it tells attackers exactly which website each credential belongs to. There is no guesswork, no trial and error. A criminal downloads this file and immediately knows which accounts to target. Combined with plaintext passwords that require no decryption, the NullCyber dump hands attackers a complete account access toolkit. Anyone whose credentials appear in this file is at immediate risk of account takeover, especcially if they reuse passwords across multiple sites.

What the NullCyber Cloud ULP Dump Exposed

• Email Addresses
• Plaintext Passwords (no hashing or encryption)
• URLs (exact websites paired with each credential)

Why the NullCyber Exposure Creates Cascading Account Risk

When credentials are stolen and published in a structured format like this, the damage spreads well beyond a single account. Attackers run automated credential stuffing tools that test each email and password pair across banking sites, email providers, e-commerce platforms, and social media simultaneously. A single working login from this file can unlock a chain of connected accounts. From there, criminals can commit finacial fraud, intercept two-factor authentication codes, impersonate victims to their contacts, and build identity profiles for longer-term exploitation. The NullCyber infrastructure is specifically designed to make this process efficient at scale.

How NullCyber-Style Stealer Log Operations Work

NullCyber and similar operations do not typically hack individual companies. Instead, they deploy information-stealing malware that infects individual devices. Victims encounter this malware through pirated software, fake game cheats, malicious email attachements, or compromised websites. Once the malware is running, it silently extracts every saved password from the victim's browsers, records keystrokes, and captures session tokens. This data is then formatted into ULP files -- organized by URL, login, and password -- and uploaded to private Telegram channels where paying subscribers can download them. The result is a massive, constantly refreshed supply of working credentials harvested from everyday users around the world.

Check If Your Accounts Appeared in the NullCyber Cloud Breach

HEROIC has indexed over 400 billion records across thousands of breach files, stealer logs, and credential databases. If your email address was included in the NullCyber Cloud ULP file or any other known breach, our free scanner will show you exactly what was exposed. Search your email at HEROIC now and find out whether your credentials are already circulating on dark web markets -- before attackers use them.