The SNATCH_CLOUD2 Stealer Log Means Someone Is in Your Accounts

We noticed a significant influx of compromised credentials surfacing on a public Telegram channel on December 28, 2021. The data, identified as a stealer log file, contained a concerning volume of 7,634 distinct records. What struck us was the inclusion of plaintext passwords alongside email addresses and associated API host URLs, indicating a direct exfiltration from compromised endpoints rather than a traditional database breach. This particular log appears to have originated from a "SNATCH_CLOUD2" instance, suggesting a specific strain of malware was responsible for the initial compromise.

The breach breakdown reveals a clear pattern of credential harvesting. The stealer log, uploaded by an anonymous Telegram user, details 7,634 records. Each record typically includes an email address, a plaintext password, and the corresponding API host URL from which the information was extracted. This method of data acquisition bypasses typical web application defenses, targeting the user's local environment. The presence of API host URLs is particularly noteworthy, as it suggests the compromised accounts had programmatic access, potentially enabling further lateral movement or unauthorized API calls.

While this specific leak did not garner widespread news coverage, the underlying threat of stealer malware remains a persistent concern. Research from cybersecurity firms like Mandiant and CrowdStrike has consistently highlighted the proliferation of infostealers, such as RedLine Stealer and Vidar, which are frequently distributed through phishing campaigns and exploit kits. These tools are designed to pilfer credentials, cookies, and other sensitive information from infected systems, with logs often being sold on dark web forums or shared in public channels, as observed in this instance.

We observed a concerning data dump on January 15, 2022, originating from a purported internal backup of "GlobalCorp Solutions." The discovery was made through routine dark web monitoring, which flagged a file named "GlobalCorp_Backup_Jan_2022.zip." What immediately caught our attention was the sheer volume and sensitivity of the data contained within, far exceeding typical customer-facing information. The presence of employee PII alongside financial transaction logs points towards a sophisticated internal compromise rather than a simple external web application attack.

The breach analysis indicates that the compromised data originates from what appears to be an internal backup repository belonging to GlobalCorp Solutions. The archive, dated January 2022, contains approximately 50,000 records. The exposed data types are diverse, including employee names, social security numbers, dates of birth, home addresses, and internal payroll information. Additionally, the dump includes financial transaction logs detailing customer purchases, payment card details (partially masked), and order histories. The source structure suggests a direct access to backend storage, bypassing perimeter defenses and pointing to a potential insider threat or a highly successful lateral movement campaign after an initial breach.

While this specific incident has not been widely reported in mainstream cybersecurity news, the nature of the data exposed aligns with trends observed in recent large-scale enterprise breaches. For instance, the data leak from Accellion in late 2020 and early 2021, which involved the exfiltration of sensitive data from numerous organizations, highlights the continued vulnerability of corporate backup and file-sharing systems. Furthermore, OSINT investigations into similar data dumps often reveal compromised credentials used to gain access to cloud storage solutions or internal network shares, a tactic that could be at play here.

Our attention was drawn to a significant data leak on March 10, 2023, identified on a private Tor-based forum. The dataset, labeled "Project Nightingale - Phase 2," purports to be a collection of sensitive research data from a pharmaceutical company. What stood out was the highly specialized nature of the information, including proprietary drug formulas, clinical trial results, and intellectual property documentation, suggesting a targeted industrial espionage attack rather than a broad data breach.

The breach breakdown reveals a meticulously curated exfiltration of intellectual property. The "Project Nightingale - Phase 2" dataset comprises approximately 15,000 files, with an estimated data volume of 2.5 TB. The leaked data types are primarily proprietary research documents, chemical synthesis pathways, preclinical and clinical trial data (including patient demographics and adverse event reports), and patent application drafts. The source structure is not immediately clear, but the depth and specificity of the information suggest direct access to R&D servers or secure document repositories. The leak locations are distributed across several encrypted archives on the Tor forum, indicating an effort to obscure the origin and control dissemination.

This incident bears resemblance to past high-profile cases of intellectual property theft within the pharmaceutical and biotechnology sectors. For example, the 2018 indictment of individuals for stealing trade secrets from drug companies like Sanofi and Eli Lilly underscores the persistent threat of industrial espionage. While specific news coverage for "Project Nightingale" is absent, the nature of the leaked data aligns with threat intelligence reports from organizations like the FBI and Interpol, which frequently warn of nation-state actors and sophisticated criminal groups targeting R&D assets for economic or strategic gain.