Our Analysts Found the TOR_LOG MIX 616 Dump Circulating in Private Telegram Channels

We're seeing a concerning uptick in stealer logs surfacing on Telegram channels, often packaged as "TOR_LOG MIX" files. What really struck us about this particular incident wasn't the number of records, but the targeted nature of the data. The logs appear to be curated, focusing on specific credentials and API keys rather than a broad sweep of user data. This suggests a more sophisticated actor with specific targets in mind, potentially using stealer malware as a reconnaissance tool before launching more targeted attacks. The data had been circulating quietly, but we noticed overlaps with known breached credentials used in recent supply chain attacks.

The "TOR_LOG MIX 616" Stealer Log: A Snapshot of Targeted Credential Harvesting

A Telegram user uploaded a stealer log file, dubbed **"TOR_LOG MIX 616,"** in **November 2023**, exposing **8,906** records. This wasn't just another indiscriminate dump of stolen data; the file contained a focused collection of endpoint information, email addresses, API host details, and, critically, plaintext passwords. What caught our attention was the presence of API keys alongside user credentials, indicating a potential interest in accessing backend systems and services. This type of breach matters to enterprises because it highlights the ongoing threat of stealer malware as a means of gathering not just user data, but also the keys to the kingdom – access to critical infrastructure. The incident underscores the growing trend of attackers using automated tools to harvest credentials and API keys, which are then traded or used directly in follow-on attacks.

Breach Stats:
* Total records exposed: **8,906**
* Types of data included: **Email Addresses, Plaintext Passwords, URLs, API host details**
* Sensitive content types: **Potentially sensitive API keys**
* Source structure: **Stealer log file**
* Leak location(s): **Telegram channel**
* Date of first appearance: **01-Nov-2023**

External Context & Supporting Evidence

The appearance of stealer logs on Telegram channels is a well-documented phenomenon. Security researchers have observed a thriving ecosystem where these logs are bought, sold, and traded, often with specific targeting criteria. A recent report by BleepingComputer highlighted the increasing use of Telegram as a platform for distributing malware and stolen data, noting the ease with which threat actors can connect and share resources. This incident aligns with that trend, demonstrating how readily available these stolen credentials are and the speed with which they can be weaponized.