Dark Web Intel: 2,671 Credentials From the RAZERTOP_BUYING_INVITE_TO_PRIVATE_CLOUD_2 Dump

In December 2022, HEROIC analysts monitoring dark web and Telegram channels detected a stealer log upload attributed to the RAZERTOP_BUYING_INVITE_TO_PRIVATE_CLOUD_2 dataset. The log contained 2,671 records harvested from infected user devices and included email addresses, plaintext passwords, and URLs linked to private cloud services. This was the second in a series of related logs shared by the same threat actor, indicating a sustained campaign to collect and distribute stolen credentials through Telegram.

Why This Is Dangerous

Credentials leaked in plaintext require no additional effort from an attacker. They can be used immediatly to attempt logins on the targeted services. Private cloud account access is particularly high-value because it can expose stored files, shared folders, and linked payment methods. With URLs also included in the dataset, attackers had a direct map to which services each victim used, removing any guesswork from their attacks.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Private Cloud and API Host URLs

Why This Matters

This leak is part of a broader pattern where threat actors collect stealer logs over time and distribute them in batches through Telegram. The second release of private cloud credentials suggests the attacker had ongoing access to a network of infected machines and was systematically pulling credentials from them. For victims, this means their accounts may have been accessible to criminals for an extended period before the log was even made public. Credential stuffing, identity theft, and unauthorized access to stored files are all real riskes tied to this type of exposure.

How Private Cloud Credential Theft Works

Stealer malware targets private cloud accounts by watching for login activity on the infected device. When a user opens their cloud storage app or visits a cloud login page, the malware captures the username and password in real time. It also looks for saved credentials inside browser storage and password managers. These credentials are then packaged into a log file and sent to the attacker, who can sort them by service type and begin trying to access accounts. Because many cloud services store sensitive personal and professional documents, even a single compromised account can have significant consequences for the victim.

Check If You Are Affected

If you use private cloud storage or file sharing services and think your account may have been caught up in this or a related leak, HEROIC's free identity monitoring tool can help. Our database holds over 400 billion leaked records and is continuously updated. Enter your email to find out if your credentials have been exposed and protect your accounts before it is too late.