Our Analysts Found the SunCloudNew 1321 Dump With 90,945 Plaintext Logins

HEROIC analysts found the SunCloudNew 1321 stealer log circulating in private Telegram channels in October 2025. The dump, labeled as a 411K ULP (URL:Login:Password) file, exposed 90,945 records containing email addresses, plaintext passwords, and associated URLs harvested from compromised machines. ULP files are a structured credential format widely traded among threat actors and are used directly for automated account takeover attacks without any further processing required.

Why This Is Dangerous: What Attackers Do With 90,945 Plaintext Credentials

Unlike hashed passwords that require cracking, the credentials in the SunCloudNew dump are ready to use immediately. Attackers load ULP files into automated tools and run them against hundreds of websites simultaneously. With 90,945 records in a single batch, even a 1% success rate yields nearly 1,000 compromised accounts. The email-password-URL structure means attackers already know exactly which service each credential belongs to, eliminating guesswork and dramatically accelerating the attack timeline.

Data Exposed in the SunCloudNew 1321 Stealer Log

• Email Addresses
• Plaintext Passwords
• URLs (target services and login endpoints)

Attack Chains Enabled by ULP Credential Dumps

A ULP file like SunCloudNew 1321 enables several high-impact attack chains. Credential stuffing tools like Sentry MBA or Openbullet can test all 90,945 credential pairs against major platforms within hours. Successful logins give attackers access to email inboxes, social media accounts, and financial services. From there, account takeover escalates to identity theft, fraudulent purchases, and lateral movement into business systems. Because many users reuse passwords, a single leaked credentail can unlock multiple accounts across diferent platforms.

What Is a ULP Stealer Log and How Did It Get Created

ULP stands for URL:Login:Password, a structured format produced by infostealer malware. When a stealer infects a device, it extracts saved browser credentials and formats them into ULP lines that pair the service URL with the corresponding username and password. This makes the data immediately actionable. The SunCloudNew batch was assembled from stealer logs aggregated across many infected machines and uploaded to Telegram for distribution to criminal buyers. These batches can range from a few hundred records to millions, and private Telegram channels often distribut them within hours of collection.

Find Out If Your Credentials Are in This Breach

HEROIC's free breach scanner searches over 400 billion exposed records, including stealer logs and ULP dumps like SunCloudNew 1321. Enter your email address to see if your credentials have been compromised and get actionable steps to secure your accounts before attackers use them. Check your exposure free at HEROIC and stay ahead of credential-based attacks.