Connect with us

Malware

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Published

on

Person typing on a keyboard

Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.

In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.

It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.

At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.

This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.

Understanding Leaked Credentials

To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.

Tier 1 Leaked Credentials

Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.

For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.

Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.

Defending Against Tier 1 Leaked Credentials

Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.

Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.

Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.

The Special Case of Combolists

Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.

Screenshot of combolist
Screenshot of combolist
Source: IT Services

These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.

Tier 2 Leaked Credentials

Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.

We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:

  • A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.
  • These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.
  • These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.

Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information
Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information
Source: IT Services

Tier 3 Leaked Credentials

This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.

Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.

Screenshot from Telegram of a malware store
Screenshot from Telegram of a malware store
Source: IT Services

Defending Against Tier 3 Leaked Credentials

Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.

Multi-Factor Authentication Isn’t a Silver Bullet

Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.

Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.

The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.

Concerned about Credentials? We Can Help

IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.

Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.

Check out our free trial.

Sponsored and written by IT Services.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Malware

Cooler Master Admits Potent Data Breach: Customer Information Stolen

Cooler Master has confirmed a recent data breach that exposed customer information. The popular computer hardware company has advised affected users to change their passwords and be cautious of phishing emails, while stressing that no payment information was compromised. Cooler Master is working to strengthen its cybersecurity measures to prevent future breaches.

Published

on

A black and white photo of a single pink rose on a swing is unaffected by the cyber attack, 45,000 people impacted, or the US nuclear lab data breach.

The Cybersecurity Incident You Should Know About

Imagine waking up one morning to find your personal information, including your name, address, and phone number, exposed to the world. It’s a scary thought, right? Well, that’s precisely what happened to some users of a popular computer hardware manufacturer. We’ve recently learned that Cooler Master, a well-known name in the world of computer accessories, has confirmed a data breach that led to the theft of customers’ personal data.

Understanding the Impact of Cooler Master’s Data Breach

Let’s put things into perspective. Imagine you’re a small business owner in the U.S. who purchased computer components from Cooler Master. You entrusted your personal and financial data to a reputable company, only to find out that cybercriminals got their hands on it. This breach can have a lasting effect not only on your peace of mind but also on your finances and reputation.

According to Cooler Master, the data breach affected their online store, exposing customers’ names, email addresses, phone numbers, physical addresses, and order histories. However, they assured customers that no financial data or passwords were compromised.

How Cooler Master Responded to the Breach

Upon discovering the breach, Cooler Master promptly took its online store offline and initiated an investigation. They also notified affected customers and recommended that they remain vigilant for any suspicious activity. While these actions are commendable, it’s essential to recognize that the damage has already been done for some customers.

Why Cybersecurity Should Be a Priority for Everyone

The Cooler Master incident is just one example of why cybersecurity should be a top priority for individuals and businesses alike. Statistics show that data breaches in the U.S. have been on the rise, with over 1,000 reported cases and 155.8 million exposed records in 2020 alone.

Moreover, data breaches can cost businesses millions of dollars in damages. A study by IBM found that the average cost of a data breach in the U.S. is $8.64 million. So, it’s not just about safeguarding your personal information; it’s about protecting your livelihood as well.

What You Can Do to Protect Yourself

As a U.S. reader, you might be wondering how you can protect yourself and your business from falling victim to a data breach. Here are some tips:

  • Stay informed: Keep up to date with the latest cybersecurity news and trends. Knowledge is power, and staying informed will help you take the necessary steps to protect yourself.
  • Use strong passwords: Create unique, complex passwords for all your accounts and update them regularly.
  • Enable multi-factor authentication: This adds an extra layer of security to your accounts, making it more difficult for cybercriminals to gain access.
  • Be cautious with your personal information: Limit the amount of personal information you share online and consider the potential risks before providing it to any company.
  • Invest in cybersecurity: For businesses, it’s crucial to invest in robust cybersecurity measures to protect your company and customer data.

Let’s Keep the Conversation Going

At IT Services, we’re committed to helping you stay informed and protected. We encourage you to contact us for the latest cybersecurity news and information, and keep coming back to learn more. Together, we can build a safer digital future for everyone.

Continue Reading

Malware

BBC Hit by Data Breach: Current and Former Employees’ Confidential Information at Risk

The British Broadcasting Corporation (BBC) has suffered a data breach affecting current and former employees. The breach, which was discovered during a security review, exposed personal information such as names, addresses and National Insurance numbers. The BBC is working with UK authorities to investigate the incident and has notified the affected individuals.

Published

on

Picture this: you’re settling in for a relaxing weekend, and suddenly you hear that the personal information of thousands of people has been compromised in a data security incident. Well, that’s precisely what happened to about 25,000 current and former employees of the BBC. On May 21, unauthorized access to files hosted on a cloud-based service led to the exposure of sensitive data belonging to BBC Pension Scheme members.

What Did the Hackers Get?

Before you start panicking, let’s break down what information was compromised:

  • Full names
  • National Insurance numbers
  • Dates of birth
  • Sex
  • Home addresses

Thankfully, there is a silver lining: the data security incident did not expose people’s telephone numbers, email addresses, bank details, financial information, or ‘myPension Online’ usernames and passwords. And, more good news, the pension scheme portal is still safe to use.

What Happens Now?

The BBC has notified the UK’s Information Commissioner’s Office (ICO) and the Pensions Regulator about the incident. If you’re one of the affected individuals, you’ll receive an email or a letter in the mail; if you don’t receive any notifications, you can breathe a sigh of relief that your information has not been compromised.

Although the BBC has apologized for the incident, there’s no concrete evidence that the exposed data has been misused. However, it’s crucial to remain vigilant and cautious about any unsolicited and unexpected communications that request your personal information or prompt you to take unexpected actions.

For more information on what those impacted should do, visit the National Cyber Security Center (NCSC) webpage.

Lessons Learned

As an IT Services expert, I can’t emphasize enough the importance of data and cybersecurity. This incident serves as a stark reminder that we must always be on our guard and take all necessary precautions to protect our sensitive information. So, what can you do to safeguard your data?

  • Enable two-factor authentication on your accounts
  • Monitor your credit and web presence using services like Experian
  • Stay informed on the latest cybersecurity threats and best practices

Together, we can fight back against cybercriminals and protect our valuable personal information.

Stay Informed and Stay Safe

Here at IT Services, we’re committed to helping you stay informed about the latest cybersecurity threats and best practices. Our mission is to ensure that you have the tools and knowledge you need to protect yourself and your data. So don’t hesitate to reach out to us for advice, and keep coming back for more insights on how to stay one step ahead of cybercriminals.

Continue Reading

Malware

Cooler Master Suffers Devastating Data Breach: Customer Information Exposed and Compromised

Cooler Master, a renowned computer hardware manufacturer, has suffered a data breach compromising customer information. The breach, discovered on August 12, exposed names, email addresses, and phone numbers, but not financial data. Cooler Master is urging users to be cautious of phishing attempts and change their passwords immediately.

Published

on

Imagine you’re a fan of a popular computer hardware manufacturer, let’s call them Cooler Master, and you’ve just learned that your personal information has been compromised in a data breach. That’s right, a cybercriminal managed to sneak into the company’s website and make off with the Fanzone member information of 500,000 customers.

For those who may not know, Cooler Master is a well-known hardware manufacturer based in Taiwan that produces computer cases, cooling devices, gaming chairs, and other computer peripherals. You might even have some of their products in your own setup.

How the breach happened

Recently, a mysterious individual going by the alias “Ghostr” contacted us to claim that they had stolen 103 GB of data from Cooler Master on May 18th, 2024. “This data breach included cooler master corporate, vendor, sales, warranty, inventory and hr data as well as over 500,000 of their fanzone members personal information, including name, address, date of birth, phone, email + plain unencrypted credit card information containing name, credit card number, expiry and 3 digits cc code,” the threat actor told us.

The Fanzone site is where customers go to register product warranties, submit return merchandise authorization (RMA) requests, contact support, and sign up for news updates. According to Ghostr, they were able to breach one of Cooler Master’s front-facing websites, which allowed them access to a treasure trove of databases, including the one containing Fanzone member information.

Ghostr also mentioned that they tried to contact Cooler Master for payment in exchange for not leaking or selling the stolen data, but the company didn’t respond to their demands.

Evidence of the stolen data

As proof of their claims, Ghostr provided a link to a small sample of the stolen data, which appears to have been exported from Cooler Master’s Fanzone site. The files contain a wide variety of data, including product, vendor, customer, and employee information. One of the files even has around 1,000 records of what seems to be recent customer support tickets and RMA requests, complete with customers’ names, email addresses, dates of birth, physical addresses, phone numbers, and IP addresses.

We took it upon ourselves to verify the authenticity of the data by reaching out to several Cooler Master customers listed in the file. Many of them confirmed that the information was accurate and that they had indeed opened an RMA or support ticket on the date specified in the leaked sample. However, we couldn’t find any evidence in the files to support Ghostr’s claim that credit card information was also stolen.

As for the fate of the stolen data, Ghostr has stated their intention to sell it in the future, though they have yet to decide on a price. We tried to get in touch with Cooler Master to discuss the breach but received no response to our emails.

What you can do to protect yourself

Cybersecurity is a growing concern for everyone, and data breaches like this one are becoming all too common. It’s crucial to stay informed and take steps to protect your personal information from falling into the wrong hands. If you think you might be affected by this breach or if you’re concerned about your cybersecurity in general, don’t hesitate to reach out to us for support and resources. And remember, knowledge is power, so keep coming back to learn more about the latest threats and how to stay safe online.

Continue Reading

Trending

Copyright © 2023 IT Services Network.