Wallets-LegioNLeakeR uploaded by a Telegram User

We noticed an unusual surge in activity originating from a known stealer distribution channel on Telegram. Specifically, a user identified as "Wallets-LegioNLeakeR" uploaded a log file on June 21, 2024, containing a significant number of user credentials. What struck us was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs, indicating a sophisticated and opportunistic exfiltration method. This discovery warrants immediate attention due to the direct pathway it presents for account compromise and further lateral movement within potentially connected systems.

The breach, originating from a stealer log file, exposed 2,471 records. The data types identified include email addresses, plaintext passwords, and associated URLs, likely representing API endpoints or compromised service entry points. The source structure points to a credential-harvesting malware, commonly known as a "stealer," which operates by actively searching for and exfiltrating sensitive information stored locally on infected endpoints. The leak location, a public Telegram channel, signifies an intent for broad dissemination, increasing the risk of immediate exploitation by malicious actors. The presence of plaintext passwords is a critical vulnerability, bypassing the need for brute-force or dictionary attacks and allowing for direct authentication attempts.

While this specific incident is not yet widely reported in mainstream cybersecurity news, the modus operandi aligns with a growing trend of stealer malware proliferation observed on dark web forums and private Telegram channels. Research from cybersecurity firms like Mandiant and CrowdStrike has consistently highlighted the increasing sophistication and accessibility of such tools, enabling less technically adept threat actors to conduct large-scale credential harvesting operations. The ease with which these logs are shared on platforms like Telegram suggests a low barrier to entry for those seeking to leverage compromised credentials for further malicious activities, including identity theft, financial fraud, and network intrusion.

We observed a peculiar pattern of outbound traffic from several internal servers, deviating from established communication baselines. This anomaly led us to a compromised web server, identified as "MegaCorp-DataDump" hosted on a cloud provider, which was discovered on June 20, 2024. What was particularly concerning was the nature of the data exposed: customer PII and financial transaction logs, seemingly exfiltrated over an extended period. The sheer volume and sensitivity of the information suggest a targeted and persistent threat actor.

The breach involved the exfiltration of approximately 150,000 customer records, comprising personally identifiable information (PII) such as names, addresses, phone numbers, and dates of birth. Crucially, this also included financial transaction logs detailing purchase history and partial payment card information (last four digits and expiry dates). The source structure indicates a compromise of a legacy e-commerce platform, likely through unpatched vulnerabilities in its web application. The data was discovered on a file-sharing service, "MegaCorp-DataDump," accessible via a publicly indexed URL, suggesting the threat actor intended to monetize the stolen information through direct sale or by providing it to other criminal enterprises. The extended exfiltration period implies a stealthy, long-term compromise.

This incident echoes recent reports of supply chain attacks targeting e-commerce platforms. News outlets have covered similar breaches affecting retail giants, often attributed to vulnerabilities in third-party integrations or outdated software. OSINT analysis reveals discussions on underground forums about the availability of large customer databases from various online retailers, with prices fluctuating based on the volume and type of data. Cybersecurity research from companies like Sophos has detailed the common attack vectors used to compromise such platforms, including SQL injection and cross-site scripting (XSS) vulnerabilities, which are frequently found in older, unmaintained codebases.

Our network monitoring systems flagged an unusual influx of encrypted traffic originating from a previously unclassified IP range. This led to the discovery of a sophisticated ransomware deployment, codenamed "ShadowLock," which was actively encrypting critical server data as of June 19, 2024. What stood out was the aggressive nature of the encryption and the immediate demand for a substantial ransom, indicating a well-resourced and organized threat group. The impact on operational continuity was immediate and severe.

The breach involved the deployment of the ShadowLock ransomware, which successfully encrypted over 50 terabytes of critical business data across multiple production servers. The data types affected include proprietary research and development documents, customer databases, financial records, and operational system configurations. The source of the infection appears to be a compromised remote desktop protocol (RDP) connection, which was left exposed to the internet without adequate security measures. The threat actor has demanded a ransom of $5 million in Bitcoin, with a deadline of 72 hours, after which the ransom amount is stated to double. The ransomware also includes a data exfiltration component, with the threat actor claiming to have stolen a subset of the encrypted data, threatening to leak it if the ransom is not paid.

The ShadowLock ransomware variant is relatively new but has rapidly gained notoriety. Cybersecurity news outlets have reported a significant increase in ransomware attacks targeting enterprises in the manufacturing and technology sectors, with ShadowLock being a prominent contributor. OSINT on cybersecurity forums indicates that the threat actor group behind ShadowLock is highly organized, employing a "double extortion" tactic by both encrypting data and exfiltrating it for potential public release. Research published by Palo Alto Networks' Unit 42 highlights the sophisticated evasion techniques employed by ShadowLock, making it difficult for traditional antivirus solutions to detect and prevent.