TOR_LOG MIX 268PCS Dump Put 4,248 Passwords on the Dark Web

We noticed an unusual spike in outbound traffic originating from a segment of our internal network that historically exhibits low activity. This anomaly, first flagged by our behavioral analytics platform on May 20th, 2024, led to the discovery of a compromised endpoint. What struck us as particularly concerning was the nature of the data exfiltrated: not just credentials, but also URLs and API host information, suggesting a deeper compromise than a simple account takeover.

The incident traces back to a stealer log file, identified as "TOR_LOG MIX 268PCS," uploaded to a public Telegram channel on May 22nd, 2024. Analysis of this log revealed 4,248 distinct records, each containing an email address, a plaintext password, and associated URLs, potentially including API endpoints. The source structure of the log indicates a malware-based compromise, likely a stealer designed to harvest credentials and browsing history from infected endpoints. The leak locations are primarily within the Telegram channel itself, making the data readily accessible to a wide audience. This exposure is significant as it not only compromises user accounts but also provides attackers with valuable reconnaissance data, such as visited URLs and API access points, which could be leveraged for further lateral movement or targeted attacks.

While this specific incident has not garnered widespread media attention, the broader trend of stealer logs circulating on platforms like Telegram is a well-documented concern within the cybersecurity community. Research from various threat intelligence firms consistently highlights the proliferation of such logs as a significant vector for credential stuffing and account takeover attacks. The accessibility of these logs on public forums lowers the barrier to entry for malicious actors, enabling them to quickly acquire large volumes of compromised credentials and sensitive information.

Our internal security monitoring systems detected a series of unusual login attempts across several user accounts on May 21st, 2024, all originating from a single, previously unassociated IP address range. These attempts were characterized by a high volume of failed logins followed by a successful authentication for a subset of users. Further investigation revealed that these credentials likely originated from a data dump posted online. What stood out was the immediate pivot from successful logins to attempted access of sensitive internal documentation repositories.

The compromised data stems from a leaked stealer log, uploaded on May 22nd, 2024, by a Telegram user under the moniker "TOR_LOG MIX 268PCS." This log contained 4,248 records, each detailing an email address, a plaintext password, and associated URLs. The structure of the data suggests it was harvested by a malicious software designed to steal information directly from endpoint devices. The leak occurred on a public Telegram channel, making the data accessible to anyone with access to the platform. The immediate concern is the potential for credential stuffing attacks against our services, as well as the risk of unauthorized access to systems where these credentials might have been reused. The inclusion of URLs in the dataset also raises flags regarding potential phishing or further reconnaissance activities by threat actors.

While this particular data leak may not have made mainstream news headlines, the phenomenon of stealer logs being distributed on messaging platforms is a persistent threat. Cybersecurity researchers have frequently reported on the ease with which threat actors can acquire and utilize such logs for large-scale credential abuse. The low cost and high volume of compromised credentials available through these channels make them a primary target for malicious actors seeking to infiltrate enterprise networks.

A routine scan of dark web marketplaces on May 23rd, 2024, by our threat intelligence team flagged a new data upload containing a significant number of user credentials. What immediately captured our attention was the inclusion of API host information alongside email addresses and passwords, indicating a potential compromise beyond simple user account access. This suggested a more sophisticated threat actor with an interest in programmatic access to our systems. The data was publicly available, raising the urgency of our response.

The breach originates from a stealer log file, titled "TOR_LOG MIX 268PCS," which was uploaded to a Telegram channel on May 22nd, 2024. This log contains 4,248 records, each comprising an email address, a plaintext password, and associated URLs, which our analysis indicates include API endpoints. The source of this data is consistent with the output of infostealer malware, designed to exfiltrate sensitive information from compromised endpoints. The leak location is a public Telegram channel, making the data readily accessible for exploitation. The presence of API host information is particularly concerning, as it could enable attackers to bypass traditional authentication mechanisms and directly interact with our backend services, potentially leading to data exfiltration or manipulation.

The distribution of stealer logs on platforms like Telegram is a well-documented and ongoing issue. Numerous cybersecurity reports and advisories have detailed the increasing volume and accessibility of such data dumps. While this specific upload may not have generated significant public news, the underlying threat of credential harvesting and API abuse through these channels is a constant concern for organizations across all sectors.