75K Records: SunCloud ULP October 6, 2025 Leak

On October 6, 2025, the SunCloud stealer campaign delivered another payload to underground markets. A Telegram user uploaded 75,151 compromised records containing plaintext passwords, email addresses, API authentication URLs, and endpoint data. This incident marks part of an October 2025 surge in stealer log releases affecting U.S. systems.

Why October 2025 was critical: Multiple stealer campaigns (MOON LIGHT, Nullcyber, and SunCloud variants) all released logs within a single week. This coordinated timing suggests either synchronised malware distribution waves or marketplace consolidation events. When several major stealer families dump data simultaneously, it typically indicates a significant infrastructure shift, new botnet recruitment, or mass compromise of specific targets.

**What Was Exposed:**
- 75,151 plaintext passwords
- Corresponding email addresses
- API endpoint URLs and authentication hosts
- Browser credential data
- Session tokens from infected endpoints

**Why This Matters:**
The recurrence of SunCloud dumps (1306 in the naming convention suggests the 1,300th+ collection batch) indicates sustained malware distribution. Attackers don't need new malware each time; they simply redeploy the same tools to fresh victims. The October 6 release, following releases from October 5, suggests either continuous collection or inventory liquidation before law enforcement action. If you were compromised during this period, your credentials are likely circulating among multiple threat actor groups now.

**How Stealer Log Breaches Work:**
SunCloud operates through a distributed infection model. A single malware variant runs on thousands of devices, each collecting credentials independently. On predetermined dates, infected machines report data back to aggregation servers. The accumulated logs are compiled, deduplicated, and packaged for sale. Each batch release (1306, etc.) represents a separate market transaction. The close timing of releases suggests automated or near-automatic marketplace operations.

**Check If Affected:**
If your email appears in breach databases and you used any devices on October 6, 2025, assume credential compromise. Email accounts are the highest priority for recovery since they control password reset functions for other services. Enable multi-factor authentication immediately and monitor for unauthorized account access.