VELKD.de

Our monitoring systems flagged an unusual surge in credential stuffing attempts targeting accounts associated with the VELKD.de domain. This led us to investigate a dataset circulating on a well-known dark web forum, dated August 26, 2018. What struck us immediately was the relatively small, yet specific, nature of the compromised data, suggesting a targeted extraction rather than a broad sweep. The presence of MD5 hashed passwords, while an older hashing algorithm, still presents a significant risk if not properly salted or if common password patterns are employed by users.

The breach, affecting the online platform for the United Evangelical Lutheran Church of Germany (VELKD.de), exposed approximately 4,521 records. The leaked data primarily comprises email addresses and MD5 hashed passwords. Analysis of the data structure indicates a direct database dump, likely originating from a compromised user authentication table. The exposure on a prominent hacking forum signifies a high probability of this data being incorporated into broader credential stuffing lists, increasing the attack surface for associated user accounts. The threat theme here is clearly credential compromise, with the potential for phishing and further account takeovers.

While this specific breach from 2018 did not generate widespread mainstream news coverage at the time, its inclusion in subsequent larger data leak compilations means it could have been leveraged by attackers for years. Research into MD5 vulnerabilities highlights that even with a dated hashing method, brute-force attacks against common password patterns remain a viable threat vector. The fact that this data resurfaced on a public forum underscores the persistent risk of older, less secure credential stores being exploited.

Our threat intelligence platforms recently detected unusual network traffic patterns originating from a previously unmonitored IP range, correlating with a significant influx of failed login attempts across several of our managed cloud services. Further investigation revealed these attempts were leveraging a dataset containing credentials associated with the "GlobalLogisticsSolutions.com" domain, leaked on or around October 12, 2021. What is particularly concerning is the sophistication of the attack vectors observed, moving beyond simple brute-force to include more nuanced evasion techniques, suggesting a well-resourced adversary.

The incident involves a data leak from GlobalLogisticsSolutions.com, affecting an estimated 150,000 user records. The exposed data includes full names, email addresses, phone numbers, and bcrypt hashed passwords. The source structure appears to be a direct exfiltration from a customer relationship management (CRM) database, likely through SQL injection or a similar web application vulnerability. The leaked data was subsequently found distributed across several private Telegram channels frequented by cybercriminals specializing in corporate espionage and ransomware deployment. The primary threat theme is account takeover and the potential for follow-on attacks, including phishing campaigns targeting both employees and customers, and the exploitation of privileged access if any compromised accounts held such permissions.

While the initial leak did not garner significant mainstream media attention, it was referenced in several cybersecurity research reports detailing the growing trend of logistics and supply chain companies becoming targets. Open-source intelligence (OSINT) suggests that the threat actor group responsible for this leak has a history of targeting critical infrastructure and supply chain entities. Research into bcrypt hashing confirms its robustness against common cracking techniques, but the sheer volume of records implies that even a small percentage of weak passwords could be compromised, providing initial footholds for attackers.

We observed a sudden spike in outbound data transfer from a legacy internal development server, which was not anticipated in our normal operational parameters. The timing coincided with a series of anomalous administrative access events on that same server, occurring between the late hours of November 3, 2022, and the early morning of November 4, 2022. What is particularly alarming is that this server, while containing sensitive historical project data, was believed to be isolated from external networks and had not been actively maintained for several years, making its compromise a significant oversight.

The breach originated from a development server for "Project Nightingale," an internal initiative from Innovatech Solutions that was decommissioned in 2019. The leak, discovered on November 5, 2022, exposed approximately 2,000 records. The data types include employee names, internal project code snippets, and unencrypted sensitive API keys. The source structure indicates a direct file system exfiltration, likely facilitated by an authenticated user or a malware implant that gained elevated privileges. The data was found uploaded to a private file-sharing service, accessible via a unique, albeit easily guessable, URL. The threat theme here is intellectual property theft and the potential for exploitation of exposed API keys to access other internal or third-party services, posing a significant risk of unauthorized system access and data manipulation.

This incident has not been publicly reported, likely due to the internal and historical nature of the compromised data. However, the presence of unencrypted API keys is a critical vulnerability that could have far-reaching implications if those keys are still active or have been reused across other systems. Our internal threat hunting has identified similar patterns of dormant server compromise in other organizations, highlighting a persistent blind spot in the management of legacy infrastructure. Further investigation into the access logs for the development server revealed a series of failed attempts to access production systems prior to the data exfiltration, suggesting a reconnaissance phase before the actual breach.