Malware

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Published

8 months ago

January 25, 2024

Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.

In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.

It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.

At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.

This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.

Understanding Leaked Credentials

To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.

Tier 1 Leaked Credentials

Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.

For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.

Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.

Defending Against Tier 1 Leaked Credentials

Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.

Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.

Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.

The Special Case of Combolists

Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.

Screenshot of combolist
Source: IT Services

These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.

Tier 2 Leaked Credentials

Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.

We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:

A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.

These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.

These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.

**Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information**
*Source: IT Services*

Tier 3 Leaked Credentials

This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.

Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.

**Screenshot from Telegram of a malware store**
*Source: IT Services*

Defending Against Tier 3 Leaked Credentials

Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.

Multi-Factor Authentication Isn’t a Silver Bullet

Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.

Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.

The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.

Concerned about Credentials? We Can Help

IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.

Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.

Check out our free trial.

Sponsored and written by IT Services.

Up Next

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Don't Miss

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Click to comment

Malware

Outlast Game Development Hits Roadblock: Red Barrels Battles Devastating Cyberattack

Game development company Red Barrels has delayed the release of upcoming game Outlast: Trials after falling victim to a cyberattack. The company’s servers were compromised, leading to a temporary loss of data and a disruption in the development process. The incident highlights the growing threat of cyberattacks targeting the gaming industry.

Published

16 hours ago

October 5, 2024

zendzipr

In a dark rural scene with abandoned houses and crows, the glowing title "Outlast II" is centered, hinting at the eerie tale crafted by Red Barrels. Hazard signs and a bicycle lie scattered, amplifying the tension in this chilling chapter of the Outlast Game series.

Imagine eagerly waiting for the next installment of your favorite video game series, only to find out that its release may be delayed. This is the reality for fans of the Outlast games, developed by Canadian gaming studio Red Barrels, as they recently suffered a cyberattack that impacted their internal IT systems and data.

How the Cyberattack Affected Production

While Red Barrels emphasizes that the attack has not affected player data, the production timeline for their games has been impacted. Founded in 2011 by industry veterans, Red Barrels is best known for its Outlast series, a popular survival horror franchise. The third and latest installment, The Outlast Trials, was released in March 2024.

In a statement, Red Barrels said, “The hit on our production timeline has been significant. We will do our best to follow our roadmap, but unfortunately, some things will have to be delayed.” As a result, fans may need to wait longer for patches, updates, and new content for the Outlast games.

Addressing the Cybersecurity Incident

Upon discovering the attack, Red Barrels deployed measures to secure their systems and the information contained therein. They also reached out to leading external cybersecurity experts to conduct an in-depth investigation into the incident. As a precautionary measure, their employees have been offered appropriate support.

While the investigation has been completed, and the breach contained, it remains unclear if the hackers stole game source code or other assets related to upcoming projects. Such a leak could potentially damage the studio if made public.

What This Means for the Gaming Industry and You

This incident serves as a stark reminder that no industry is immune to the threat of cyberattacks. As technology continues to advance and become more integrated into our daily lives, the need for robust cybersecurity measures becomes increasingly important.

For you as a consumer, this means staying informed about the risks and taking the necessary precautions to protect your own data. It’s essential to use strong, unique passwords for your accounts, enable multi-factor authentication when available, and be cautious when sharing personal information online.

Stay Informed and Stay Safe

As we continue to monitor the situation with Red Barrels and the impact of this cyberattack on their production timeline, it’s crucial for you to stay informed and vigilant in the ever-evolving digital landscape. Whether you’re an avid gamer or simply concerned about your online security, we encourage you to keep coming back to learn more about how you can protect yourself and your data.

Malware

Major Data Breach: Suspected Involvement of Powerful State Actor

Dutch police suspect a state-sponsored actor is behind a recent data breach that exposed personal information of 65,000 individuals. The compromised data, from the Dutch Research Council (NWO), includes names, emails, and affiliations of academics and government officials. The NWO has halted grant applications and payments to minimize potential damage.

Published

2 days ago

October 4, 2024

zendzipr

Close-up of a Dutch police uniform with the word "Politie" and emblem visible, hinting at suspected involvement in a data breach. A police car is slightly blurred in the background, adding to the tension of an unfolding investigation.

Imagine for a moment that your work contact information was compromised. It probably wouldn’t feel great, but it might not be too concerning. Now, imagine you’re a police officer, and your contact information, along with the names, email addresses, phone numbers, and even some private details, were stolen by a state actor. That’s what happened to the Dutch national police force (Politie) just last week.

The breach was discovered after an attacker hacked a police account and stole work-related contact information of multiple officers. With an ongoing investigation underway, the police have chosen not to publicly reveal who is responsible or how the attack was carried out until all the details have been collected and analyzed.

Who could be behind the attack?

While the police are keeping tight-lipped about the identity of the perpetrators, they have suggested that a state actor was likely involved. In other words, it’s possible that another country or individuals acting on behalf of another country carried out the attack. The police were informed by intelligence services about this possibility, and they have since implemented stronger security measures to counter the attack. However, they’re not revealing any more information at this time to avoid tipping off the attackers and jeopardizing the ongoing investigation.

What’s being done to prevent future breaches?

In response to the breach, Dutch police officers are now required to use two-factor authentication more frequently when logging into their accounts as a way to prevent unauthorized access. Additionally, the IT staff is continuously monitoring all systems for any signs of abnormal activity and is on high alert to take immediate action if needed.

How many people are affected?

While the exact number of impacted individuals hasn’t been specified, a letter to the Dutch House of Representatives from David van Weel, Minister of Justice and Security in the Netherlands, states that the work-related contact details of all police officers have been stolen. With the investigation still ongoing, more information is expected to be released when it’s deemed safe to do so without affecting the case.

Stay informed and stay safe

As cybersecurity experts, we understand the importance of staying informed and keeping your personal and professional information safe. It’s essential to be vigilant and proactive about your digital security, especially in today’s increasingly connected world. If you’d like to learn more about how to protect yourself and your organization from cyber threats, we invite you to contact us and keep coming back for more information and insights.

Malware

Rackspace Monitoring Data Breached: ScienceLogic Zero-Day Attack Exposes Critical Information

Hackers have exploited a zero-day vulnerability in ScienceLogic’s platform to steal Rackspace monitoring data. Rackspace has alerted customers of the attack, urging them to change their passwords as a precautionary measure. ScienceLogic has since released a patch to address the vulnerability.

Published

4 days ago

October 2, 2024

zendzipr

A stylized image of tall, reflective skyscrapers with "rackspace monitoring" written in the center against a bright sky.

Breaking Down the Rackspace Data Breach

Recently, cloud hosting provider Rackspace experienced a data breach that exposed “limited” customer monitoring data. The breach occurred due to threat actors exploiting a zero-day vulnerability in a third-party tool used by ScienceLogic’s SL1 platform.

ScienceLogic quickly developed a patch addressing the vulnerability and distributed it to impacted customers. However, they chose not to disclose the third-party utility’s name to avoid giving hackers any hints that could lead to further exploitation.

How the Attack Was Discovered

A user on a social media platform first disclosed the attack, claiming that a Rackspace outage on September 24 was due to active exploitation in the company’s ScienceLogic EM7. The breach resulted in access to three internal Rackspace monitoring webservers.

ScienceLogic SL1 (formerly EM7) is an IT operations platform that monitors, analyzes, and automates an organization’s infrastructure, including cloud, networks, and applications. Rackspace, a managed cloud computing company, uses ScienceLogic SL1 to monitor its IT infrastructure and services.

Dealing with the Fallout

Upon discovering the malicious activity, Rackspace disabled monitoring graphs on its MyRack portal until they could push an update to remediate the risk. However, the situation was worse than initially reported.

As first reported by The Register, Rackspace’s SL1 solution was hacked, and some customer information was stolen. Hackers gained access to web servers and stole limited customer monitoring data, including customer account names and numbers, usernames, device IDs, device names and information, IP addresses, and encrypted internal device agent credentials.

What Does This Mean for Customers?

Although Rackspace rotated the stolen credentials as a precaution and informed customers they needed to take no further action, the breach’s implications are still concerning. Exposed IP addresses can be used by threat actors to target companies’ devices in DDoS attacks or further exploitation attempts. It is unknown how many customers have been impacted by this breach.

Lessons Learned and Moving Forward

This data breach highlights the importance of staying vigilant in the ever-evolving world of cybersecurity. Companies must continuously monitor their systems and be prepared to act quickly in the event of a breach.

As an AI with expertise in cybersecurity, I encourage you to continue learning about how to protect your digital assets and infrastructure. Stay informed on the latest cybersecurity news, trends, and best practices. And most importantly, don’t hesitate to reach out to us for guidance and assistance in keeping your digital world secure.