SNATCH_CLOUD2 Stealer Log Leaked: All Records Have Plaintext Passwords

We noticed a concerning upload on December 17, 2021, originating from a Telegram user, which has since been cataloged as SNATCH_CLOUD2. This particular data dump, identified as a stealer log, contained a significant volume of sensitive endpoint information. What struck us as particularly alarming was the inclusion of plaintext passwords alongside email addresses and associated API host URLs, presenting a direct pathway for credential stuffing and unauthorized access to numerous services.

The breach breakdown reveals a stealer log file, uploaded on 17-Dec-2021, exposing 10,442 records. The leaked data types are primarily email addresses, plaintext passwords, and URLs. The source structure indicates a compromised endpoint, likely infected with the SNATCH stealer malware, which exfiltrated credentials and browsing history. The leak location was a public Telegram channel, making the data immediately accessible to a wide audience. The presence of plaintext passwords is a critical vulnerability, as it bypasses any hashing or salting mechanisms that might have been in place on the targeted services, and the inclusion of API host URLs suggests potential access to backend systems or integrated applications.

While this specific incident, SNATCH_CLOUD2, may not have garnered widespread media attention, the underlying threat of stealer malware is a persistent and evolving concern within the cybersecurity landscape. Research from various security firms, including Mandiant and CrowdStrike, consistently highlights the increasing sophistication and prevalence of information-stealing malware that targets credentials, cookies, and other sensitive data from endpoints. These logs often serve as a valuable resource for threat actors seeking to gain initial access to corporate networks through credential reuse or by exploiting compromised accounts to pivot further into an organization's infrastructure.

We observed a new entry in our threat intelligence feeds on January 5, 2022, detailing a data leak originating from a compromised web server, identified as "E-COMMERCE_LEAK_JAN22". This leak, discovered through routine dark web monitoring, contained a substantial volume of customer information. What immediately caught our attention was the structured nature of the data, indicating a targeted extraction rather than a random dump, and the inclusion of personally identifiable information (PII) alongside payment-related details.

The breach, dated January 5, 2022, involved the exfiltration of approximately 75,000 records from a mid-sized e-commerce platform. The leaked data types include customer names, email addresses, physical addresses, phone numbers, and partial credit card numbers (last four digits and expiry dates). The source structure points to a SQL injection vulnerability exploited on the web server's database. This breach is particularly concerning due to the combination of PII and payment card information, which can be leveraged for identity theft, financial fraud, and further social engineering attacks. The leak was discovered on a private forum frequented by cybercriminals, suggesting a deliberate sale or distribution of the compromised data.

This incident aligns with broader trends in e-commerce data breaches, which have been extensively reported. For instance, a 2021 report by the Identity Theft Resource Center documented a significant increase in data compromises affecting the retail sector. Furthermore, security researchers have consistently warned about the persistent threat of SQL injection attacks against web applications, as highlighted by OWASP's Top 10 vulnerabilities. The partial credit card data, while not directly usable for fraudulent transactions, can be combined with other PII to create convincing phishing lures or to facilitate account takeovers on other platforms.

Our automated systems flagged an unusual spike in outbound traffic from a legacy internal server on February 10, 2022, leading to the discovery of a data exfiltration event. This incident, designated "LEGACY_SERVER_EXFIL_FEB22", involved the unauthorized transfer of sensitive configuration files. What struck us as particularly alarming was the nature of the data itself – detailed network configurations, service account credentials, and internal IP addressing schemes – suggesting a deliberate and targeted reconnaissance effort by an external actor.

The breach breakdown reveals that on February 10, 2022, an unauthorized actor successfully exfiltrated approximately 500 MB of data from a legacy server designated for internal network management. The leaked data types are primarily network configuration files (e.g., .cfg, .ini), plaintext service account credentials, and internal IP address lists. The source structure indicates that the actor likely gained initial access through an unpatched vulnerability on the legacy server, which was overlooked due to its age and infrequent use. The exfiltration method appeared to be a slow, low-and-slow data transfer over an encrypted tunnel, making it difficult to detect with standard network monitoring tools. The leak location was not immediately apparent, but the nature of the data suggests it was intended for internal use by threat actors seeking to map and exploit the enterprise network.

While this specific incident has not been publicly disclosed, the methodology employed is consistent with advanced persistent threat (APT) tactics. Security research from organizations like FireEye (now Mandiant) and Palo Alto Networks' Unit 42 has frequently detailed how APT groups prioritize the acquisition of internal network documentation and credentials to facilitate lateral movement and achieve their objectives within an organization. The use of legacy systems as entry points or staging grounds for data exfiltration is also a recurring theme in sophisticated attacks, as these systems often lack the robust security controls of modern infrastructure.