The SunCloudNew Breach Gave Hackers Everything They Need to Drain Accounts

HEROIC analysts catalogued a large stealer log upload to Telegram on November 21, 2025, posted by a channel operating under the name SunCloudNew. The file, labeled batch 1023 of a 4.06 million record ULP archive, contained 1,166,118 records when verified. Each entry included an email address, a plaintext password, and the URL of the service the login was tied to. The batch numbering indicates this is one installment in a long-running credential distribution operation, with the full SunCloudNew archive spanning millions of records across many releases.

Why the SunCloudNew Breach Gave Hackers Everything They Need to Drain Accounts

A ULP file structured with URL, login, and password for each record is the most complete attack package a cybercriminal can have. There is no research required, no guessing which site to target, no need to crack hashed passwords. Everything is ready to plug into an automated credential stuffing tool. With 1.1 million entries from a verified, active channel, attackers working through this file have a direct path to bank accounts, email inboxes, shopping sites, and corporate logins. Each successful entry is a gateway to financial fraud, identity theft, or further network access.

What Was Exposed in the SunCloudNew Batch 1023 ULP Stealer Log

• Email addresses
• Plaintext passwords (stored and transmitted without any encryption)
• URLs of the services each credential pair belongs to

Why Numbered Batch Releases From Ongoing Channels Represent Sustained Risk

Batch 1023 is not an isolated incident -- it is one piece of a systematic, long-term credential harvesting operation. SunCloudNew's archive reportedly spans over 4 million ULP records across its full release sequence. That means victims who appeared in earlier batches may already have been targeted, while those in batch 1023 may be encountering this exposure for the first time. Sustained operations like this one do not stop when a single batch is published. The channel keeps releasing new data, and each batch adds new victims to an ever-growing attack surface. Organisations that monitor for credential exposures need to track entire channels, not just individual files, to understad the full scop of the threat.

How Long-Running Telegram Credential Channels Like SunCloudNew Build Their Archives

Channels like SunCloudNew are not one-person operations. They aggregate logs from a network of malware affiliates who deploy stealers on behalf of the channel operator in exchange for a share of the proceeds. The operator receives raw log files from dozens or hundreds of infected machines, processes the credentials into clean ULP format, and releases them in numbered batches to paying subscribers. The batch number -- 1023 in this case -- reveals how long the operation has been running. A channel releasing over a thousand numbered batches has been operating for months or years, building a subscriber base and a reputation in criminal forums. This is industrialized credential theft at scale, not opportunistic hacking.

Check If Your Credentials Appeared in the SunCloudNew Archive

With over 1.1 million records in this single batch and millions more across the full SunCloudNew series, there is a meaningful chance that someone you know -- or you yourself -- is in this data. HEROIC's free breach scanner checks your email address against more than 400 billion exposed records, including ULP stealer log archives from long-running Telegram channels. Enter your email now to find out whether your login data was exposed -- and take action before an attacker does.