Slurm Logs Stealer Log: 9,109 Cluster Credentials Stolen

HEROIC's DarkHive intelligence system uncovered a Slurm Logs stealer log breach on March 17, 2025, exposing 9,109 records that were posted to a Telegram channel by an unknown threat actor. The compromised data included email addresses, plaintext passwords, and URLs connected to Slurm workload manager clusters and internal API endpoints, giving attackers direct paths into high-performance computing infrastructure.

Why This Is Dangerous

With 9,109 records in a single stealer log, the attack surface is significant. Slurm credentials control access to compute clusters used for sensitive scientific research, pharmaceutical modeling, financial calculations, and commercial AI workloads. An attacker with a valid Slurm credential can submit resource-intensive jobs, access stored research results, exfiltrate datasets, or leverage the computing power for cryptomining operations. The accompanying URLs in this breach provide a map of internal API services that attackers use for further penetration.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Stealer logs distributed on Telegram are downloaded by multiple criminal groups, meaning thier contents are tested across hundreds of services simultaneously. Every platform where a victim reused the same email and password combination becomes a potential entry point. This includes corporate email, cloud storage, VPNs, and banking applications. Organizations running Slurm should treat each email address found in this breach as fully compromised and require immediate password rotation across all enterprise systems those users access.

How Stealer Log Works

Stealer log malware gains access to victim machines through phishing campaigns, malicious downloads, or software supply chain attacks targeting technical users. Once active, it quietly sweeps through all credential storage locations including browser password vaults, SSH key files, and application config directories. The harvested credentials are packaged into a compact log and transmitted back to attacker infrastructure. These logs are uploaded to Telegram where they are freely shared and used to launch seperate account takeover operations against each victim listed in the file.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer log breaches like this Slurm Logs incident from March 2025. Visit heroic.com to check whether your email address appeared in this breach or any other known data leak.