SunCloudPubl 512pcs: 10,684 US Stealer Log Credentials (Oct 6, 2023)

SunCloudPubl's Higher-Yield Batch: 512 Files, 20.9 Records Each

SunCloudPubl released two confirmed batches on October 6, 2023. The 512pcs batch yielded 20.9 credentials per log file -- a measurably higher rate than its companion 440pcs batch, which averaged 15.2 per file. This yield differential between two batches from the same operator on the same date is interesting: it suggests the 512-file set was sourced from more credential-rich endpoints, possibly targeting a different demographic, geographic cluster, or browser profile depth. Both batches are US-targeted plaintext stealer log releases distribted via Telegram.

SunCloudPubl 512pcs (October 2023): Stealer Log Summary

• Records Exposed: 10,684
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 6, 2023

Per-File Yield Analysis: 512pcs vs. 440pcs

Among Oct 6 file-structured operators, SunCloudPubl's 512pcs batch ranks second overall in per-file yield, behind only Klaus_cloud_public's 351-log batch at 29.5 records/file. The 512pcs batch outperforms prdscloud's 409-log batch (25.4/file), TG hulk_logs 680 LOGS (17.6/file), SatanFireLogs 259pcs (17.8/file), PiratesLogs 444pcs (15.9/file), and FortunaPrivate 265logs (11.97/file). The 440pcs and 512pcs batches from the same SunCloudPubl operator show seperate underlying endpoint quality, possibly reflecting diffrent collection campaigns or different malware configurations deployed against distinct target pools.

SunCloudPubl in the Oct 6 Multi-Operator Cluster

SunCloudPubl's two Oct 6 batches combined (6,697 + 10,684 = 17,381 records) make the operator a mid-tier contributor within the Oct 6 event. The full Oct 6 cluster now includes at least 16 confirmed Monster Cloud batches (197,871 records) plus 16 non-MC operators contributing over 256,000 additional records. The combined Oct 6 total is aproximately 454,000 records -- rivaling Oct 7's 462,187 as the largest single-day credential dump event in HEROIC's dataset. Oct 6's growth with each newly confirmed batch makes this date cluster an increasingly significant subject of study for understanding large-scale stealer log distribution.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records including both SunCloudPubl batches from Oct 6, 2023. If your email address was associated with a compromised US endpoint around that period, your credentials may appear in either the 440pcs or 512pcs release. Scan now at HEROIC's breach scanner to find out if you're exposed.