The SNATCH_CLOUD1 Leak Contains More Records Than a Small US City

We noticed an unusual spike in outbound traffic from a specific segment of our network, prompting an immediate investigation. What struck us was the sheer volume of what appeared to be credentials and session tokens being exfiltrated, not in a targeted, sophisticated manner, but rather in a broad, opportunistic sweep. The discovery originated from our SIEM alerts, which flagged anomalous data patterns consistent with malware activity. The source of this exfiltration, upon initial analysis, pointed towards a compromised endpoint rather than a direct compromise of our core infrastructure. This incident underscores the persistent threat posed by endpoint security vulnerabilities.

The incident, identified on December 5th, 2021, stemmed from a stealer log file uploaded to a public Telegram channel by an anonymous user. This log contained 16,525 records, each representing a compromised endpoint. The leaked data includes email addresses and, critically, plaintext passwords, alongside associated URLs which likely represent the domains or services accessed by the compromised accounts. The source structure of the data suggests it was harvested by a credential-stealing malware, likely a trojan designed to capture login information from browsers and other applications. The leak location, a publicly accessible Telegram channel, amplifies the risk of further unauthorized access and misuse of the exposed credentials.

While this specific incident may not have garnered widespread mainstream news coverage, the methodology is a recurring theme in cybersecurity threat intelligence. Research from various security firms, including Mandiant and CrowdStrike, frequently highlights the impact of stealer malware campaigns that target individual endpoints to harvest credentials. These campaigns often operate at scale, with attackers leveraging compromised systems to distribute further malware or gain access to victim networks. The ease with which such logs can be uploaded and shared on platforms like Telegram presents a persistent challenge for defenders, as it democratizes access to stolen data for a wider range of malicious actors.