For example, in September, Uber revealed that an attacker compromised an Uber EXT contractor’s account and gained access to the network. On September 19, 2022, Uber released an update that the account, and likely others, were captured by when a stealer malware infected the contractor’s device and extracted credentials.

Stealer logs are several account and credential data types we frequently observe in the underground. In this article, we are going to make sense of them.

5 Cybersecurity Predictions For 2023

5 Cybersecurity Predictions For 2023 Learn how to protect yourself against a record-breaking year of cybersecurity breaches and attacks What is unique about the world we are in now – is that it is not just increasingly sophisticated technology escalating cyber conflicts – but the changing vectors of…

Cybersixgill

Stealer Logs

Stealer logs--credential data produced by stealer malware--are a common form of compromised data found in the cyber underground. Marketplaces and forum threads are dedicated to selling and distributing these logs for threat actors to gain initial access to an organization’s network quickly.

One can find evidence of these anywhere, including Telegram, forums, file-sharing sites, and marketplaces (Figure 1).

There are a variety of stealers, malicious programs designed to collect login credentials from a victim’s browser once infected, for sale, and freely available in the underground. Racoon Stealer, Redline Stealer, Azorult are some of the most common stealers Many threat actors add their flavors to the stealers with different features. For example, the following version of the Rootfinder Stealer is a variant of the Redline and Typhoon Stealer shared by a threat actor on an underground forum (Figure 2).

The stealer logs often come as a zip file with folders and txt files containing passwords, cookies, target machine information, and sometimes payment information. Here is an example of one I purchased last year and presented at my threat-hunting workshops (Figure 3).

Credentials

Leaked credentials make their way to the underground in many forms. In its simplest form,  leaked credentials are a combination of usernames and passwords distributed by threat actors for others to use in an attack. Threat actors collect these in many ways. The most common method used to reveal credentials is through credential stuffing attacks. Attackers also use tools like OpenBullet, which can provide higher confidence that the credentials are valid, and “combos” derived from third-party breaches and phishing attacks. Additionally, credentials are often dumped in large quantities, while compromised accounts are commonly sold individually.

2023 Trends: CISOs will change their approach to cybersecurity for career protection and organizational security

This year, from economic pressures and expanding attack surfaces to emerging threats with ideological and financial motivations, will see CISOs pressure increase and influence their cybersecurity decision-making.

Cybersixgill NewsCybersixgill

Cybersixgill often observes and collects leaked credentials through text or CSV files uploaded to file-hosting sites like Anonfiles, plain text lists shared in forum posts, large dumps on Pastebin, and through Telegram chat messages. Some of these dumps of credentials are simply formatted in username:password (for example, johndoe@email.com:myDictionaryPassword) (Figure 4).

In many cases, leaked credentials dumped underground have not been validated by the publishing threat actor. Therefore, others looking to engage in some attacks must go through trial and error when taking over these accounts. However, they can automate login attempts with credential-stuffing tools known on the underground as checkers. At a minimum, though, they at least have emails they can target with phishing attacks.

Accounts

Unlike leaked credentials, accounts in underground slang denote verified access to bank accounts, systems and networks, emails, and more. These are often listed for sale as the seller has confirmed access to the account and has conducted some checks into the types of privileges the account might have in a network or that the account has available funds or rewards for cashout or fraudulent transactions. The type of account for sale typically impacts the cost to the potential buyer. For example, a consumer’s Netflix account would be cheaper than a domain admin account to an internal network.

The following example shows a threat actor on a hacking forum selling shell access to Iraq’s government network (Figure 5).

The following image also shows a forum post by a threat actor sharing a verified bank account, including email, password, name, address, card number, PIN, and more (Figure 6).

2023 Trends: The rise of ’quasi-APTs” and state-sponsored threat actors

Recently, Cybersixgill shared the 2023 trends that will significantly impact cybersecurity and reshape the threat landscape. Over the next five weeks, we will delve into each trend and what government organizations and businesses can do to go beyond responding and proactively preventing attacks with…

Cybersixgill NewsCybersixgill

Summary

With so many different types of data dumps making their way to the underground, hopefully, you can quickly distinguish between logs, credentials, and accounts and how it impacts your security. Whatever the case, Cybersixgill continuously collects all types of leaked data to provide the earliest indication of risk to your organization.

Cybersixgill can help you assess, measure, prioritize, and address emerging threats.