STARLINKCLOUD2 Stealer Log: 61,216 US Credentials From a September 2023 Telegram Upload

STARLINKCLOUD2: The Second Installment of a 136,850-Record September 2023 Cluster

The STARLINKCLOUD2 stealer log dataset, uploaded to Telegram on September 29, 2023, is the second part of a two-volume stealer log release -- the first being STARLINKCLOUD (75,634 records), released the same day. Together, STARLINKCLOUD and STARLINKCLOUD2 account for 136,850 US records from a single Telegram upload event. The cloud-themed name is confiusing by design -- an installaton tactic meant to make the dataset appear more targeted or valuable than a generic credential dump. The actual data tells the familiar stealer log story: plaintext passwords, endpoint URLs, and API host data harvested from infected US devices.

STARLINKCLOUD2 (September 2023): Breach Summary

• Records Exposed: 61,216
• Data Types: Email addresses, plaintext passwords, endpoint URLs, API host data
• Breach Type: Stealer log
• Password Type: Plaintext -- directly usable with no cracking required
• Country: United States
• Date Leaked: September 29, 2023

The "2" in STARLINKCLOUD2: What Multi-Part Stealer Log Series Signal

When a stealer log release carries a numeral suffix, it typically indicates one of two things: either the data was collected in multiple batches and packaged separately, or the distributor intentionally split a single dataset to create the appearance of ongoing activity. In either case, the STARLINKCLOUD + STARLINKCLOUD2 pairing suggests the threat actor was managing two pools of infected device data collected from US targets in the same period. The STARLINKCLOUD2 batch at 61,216 records is slightly smaller than STARLINKCLOUD's 75,634 -- a size differential consistent with two infection clusters harvested over different timeframes and combined for a September 29, 2023 release day.

Endpoint URLs and API Host Data: The Infrastructure Intelligence Layer

Like its STARLINKCLOUD sibling, the STARLINKCLOUD2 dataset includes API host data alongside plaintext passwords and endpoint URLs. This combination -- consumer-facing login URLs paired with backend API host endpoints -- is the hallmark of modern stealer log data harvested from browser credential stores. Each infected device contributed both the URL layer (where credentials authenticate) and the API layer (what services those credentials talk to on the backend). For corporate users in the infection population, this dual exposure means attackers received both the front-door credentials and a map of the internal systems behind them.

September 29, 2023: The Multi-Upload Cluster Context

STARLINKCLOUD2 was one of at least four stealer log datasets uploaded to the same Telegram channel on September 29, 2023. The others -- STARLINKCLOUD (75,634 records), GODELESS CLOUD (6,986 records), and a date-named log labeled "2023-09-23" (20,795 records) -- collectively added over 164,000 US stealer log records to threat actor networks in a single day. This September 29 cluster predates the AuroraLogsTeam campaign by 18 months but follows the same coordinated multi-upload operational pattern, suggesting this approach to stealer log distribution has been a persistent tactic across multiple threat actor groups.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records including stealer log data from the September 2023 STARLINKCLOUD cluster. If your credentials appeared in STARLINKCLOUD2 or any of the concurrent September 29 uploads, they have been in circulation for over two years. Search your email for free at HEROIC.com to find out where your information has appeared.