Connect with us


Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars



Person typing on a keyboard

Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.

In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.

It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.

At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.

This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.

Understanding Leaked Credentials

To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.

Tier 1 Leaked Credentials

Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.

For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.

Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.

Defending Against Tier 1 Leaked Credentials

Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.

Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.

Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.

The Special Case of Combolists

Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.

Screenshot of combolist
Screenshot of combolist
Source: IT Services

These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.

Tier 2 Leaked Credentials

Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.

We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:

  • A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.
  • These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.
  • These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.

Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information
Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information
Source: IT Services

Tier 3 Leaked Credentials

This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.

Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.

Screenshot from Telegram of a malware store
Screenshot from Telegram of a malware store
Source: IT Services

Defending Against Tier 3 Leaked Credentials

Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.

Multi-Factor Authentication Isn’t a Silver Bullet

Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.

Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.

The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.

Concerned about Credentials? We Can Help

IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.

Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.

Check out our free trial.

Sponsored and written by IT Services.


Massive Data Breach at Golden Corral Restaurant Chain Exposes 183,000 People: Protect Yourself Now

Golden Corral, a US restaurant chain, has suffered a data breach impacting 183,000 customers. The breach exposed names, payment card numbers, and expiry dates, potentially putting customers at risk of fraud. Learn how to protect yourself and what steps the company is taking to address this security incident.



A golden coral store glows at night.

Golden Corral

Golden Corral: A Victim of Cyberattack

Did you know that the popular American restaurant chain, Golden Corral, recently disclosed a data breach? In this attack, cybercriminals stole the personal information of over 180,000 people. And it’s not just customers who are affected – the breach also impacted current and former employees and their beneficiaries.

What Happened During the Attack?

Between August 11 and August 15, attackers gained access to Golden Corral’s systems, stealing sensitive data. The company reported a temporary disruption to their corporate operations during this time. They have since notified federal law enforcement and are working to implement additional safeguards to protect their systems.

How Did Golden Corral Respond?

After determining the scope of the data breach, Golden Corral began the process of informing affected individuals. They located addresses for all impacted parties on January 26 and started sending breach notification letters on February 16. In a filing with Maine’s Attorney General, the company revealed that 183,272 individuals had their data stolen in the attack.

What Information Was Stolen?

During their investigation, Golden Corral discovered that the attackers might have stolen various types of personal information. This includes names of employees, dependents, and beneficiaries, Social Security numbers, financial account information, driver’s license numbers, medical information, usernames and passwords, and health insurance information.

What Should You Do If You’re Affected?

If you or someone you know might be affected by this breach, it’s essential to remain vigilant against incidents of identity theft. Review your account statements and explanations of benefits for any unusual activity. Report any suspicious activity to the appropriate insurance company, healthcare provider, or financial institution, as soon as possible.

Stay Informed and Protect Yourself

As an IT Services company, we understand the importance of staying informed about cybersecurity threats and taking necessary precautions to protect yourself and your personal information. Cyberattacks like the one at Golden Corral serve as a reminder that no organization is immune to these risks. So, whether you’re an individual or a business owner, it’s essential to stay educated and proactive in your approach to cybersecurity.

Contact us to stay up-to-date with the latest cybersecurity news and learn more about how you can protect your personal information and your business. By working together, we can help build a safer digital world for everyone.

Continue Reading


Massive Data Breach: 20 Million Cutout.Pro User Records Exposed on Hacker Forum

Discover the recent data breach at, a popular image-editing software, where 20 million user records were leaked on a hacker forum. Learn about the exposed information and potential risks for the affected users, as well as the company’s response to this security incident. Protect yourself from similar threats with expert advice.



A padlock on a circuit board ensures the protection of sensitive user records.

Picture this: you find an amazing AI-powered photo and video editing platform that can do everything from enhancing images to restoring old photos. You sign up and start using it, only to discover that your personal information has been exposed in a massive data breach. This is exactly what happened to 20 million members of Cutout.Pro, and it’s a sobering reminder of the importance of cybersecurity.

What Happened to Cutout.Pro?

We’ve learned that Cutout.Pro, a popular AI-based photo and video editing platform, has suffered a data breach that exposed the personal information of 20 million members. The leaked data includes email addresses, hashed and salted passwords, IP addresses, and names.

The breach was made public when someone using the alias ‘KryptonZambie’ shared a link on the BreachForums hacking forum. This link contained CSV files with 5.93 GB of data stolen from Cutout.Pro, consisting of 41.4 million records. Of these, 20 million records included unique email addresses.

Worse still, the cybercriminal claimed they still had access to the breached system, suggesting that Cutout.Pro was unaware of the compromise at the time.

What Information Was Leaked?

From the samples we’ve seen, the data leak includes the following information:

  • User ID and profile picture
  • API access key
  • Account creation date
  • Email address
  • User IP address
  • Mobile phone number
  • Password and salt used in hashing
  • User type and account status

Have I Been Pwned (HIBP), a data breach monitoring and alerting service, added the breach to its catalog, confirming that the leaked dataset includes information for 19,972,829 people. The threat actor also shared the files on their personal Telegram channel, causing a much wider circulation of the stolen data.

Although Cutout.Pro hasn’t confirmed the security incident through an official statement, HIBP’s founder Troy Hunt verified multiple matches from the leaked email addresses, and we’ve confirmed that the emails listed in the data leak match legitimate Cutout.Pro users.

What Should You Do If You’ve Used Cutout.Pro?

If you’ve used Cutout.Pro in the past, it’s crucial that you reset your password immediately on the service and any other online platforms where you might be using the same credentials. MD5 password hashes, like the ones leaked, are considered relatively easy to crack by modern standards, so it’s a real possibility that threat actors could brute-force the leaked password hashes.

Moreover, all Cutout.Pro users should be on the lookout for targeted phishing scams that attempt to gather further information from you.

Stay Informed and Stay Safe

This data breach is a stark reminder of the importance of cybersecurity and the need to stay informed about potential threats. We’re dedicated to helping you stay informed and providing information to help keep your personal information safe. Don’t hesitate to reach out to us for more information, and keep coming back to learn more about the latest in cybersecurity.

Continue Reading


Rhysida Ransomware Demands a Shocking $3.6 Million to Release Stolen Children’s Data

Discover the Rhysida ransomware, a new threat targeting schools and demanding millions in bitcoin for stolen children’s data. Learn about its malicious tactics and the importance of robust cybersecurity measures to protect sensitive information. Stay ahead of cybercriminals with our expert insights.



A logo-adorned glass skyscraper looms large.

Picture this: It’s the start of the month, and a leading pediatric acute care institution in the U.S., Lurie Children’s Hospital in Chicago, falls victim to a cyberattack. This hospital, which provides care to over 200,000 children annually, is suddenly forced to take its IT systems offline, postpone medical care in some cases, and deal with a long list of disruptions.

Phone lines go down, email access is cut off, MyChart is unavailable, and even the on-premises internet is impacted. Ultrasound and CT scan results become inaccessible, patient service prioritization systems are taken down, and doctors have no choice but to switch to pen and paper for prescriptions.

Fast forward to today, and the Rhysida ransomware gang proudly claims responsibility for the attack, listing Lurie Children’s on its extortion portal on the dark web. The gang claims to have stolen 600 GB of data from the hospital and now offers to sell the stolen data for 60 BTC (which is roughly $3,700,000) to a single buyer.

Time’s Ticking: Seven Days to Pay Up or Else

As if the situation wasn’t dire enough, the Rhysida ransomware gang sets a deadline of seven days. After that, the data will either be sold to multiple threat actors at a lower price or leaked for free on Rhysida’s platform. The clock is ticking, and the stakes are higher than ever.

Lurie Children’s Recovery: A Work in Progress

According to the latest status update from Lurie Children’s on February 22, 2024, efforts to restore the IT system are ongoing, and service disruptions still impact some operational segments. Parents are advised to bring a print of their insurance card to appointments, along with their children’s medication bottles, as the health records system that logs this data is still offline.

MyChart remains unavailable, and wait times are longer than usual as prescription preparation is still done by hand. Some procedures and appointments may be canceled and rescheduled as things are moved around to accommodate urgent care cases.

Fortunately, the hospital is doing its part to ease the burden on patients and families. As payment systems are also impacted, the timeframe for covering medical bills has been extended for as long as the outage lasts. Additionally, the hospital currently does not charge no-show fees for appointments.

A Glimmer of Hope?

Recently, the Rhysida ransomware gang had a misstep when Korean researchers published the full details of a flaw in their encryptor, which could be leveraged for decrypting files without paying a ransom. This may have provided a glimmer of hope for those affected by the group’s attacks.

However, judging from the lengthy disruption at Lurie Children’s, the decryptor that law enforcement used for many months privately may not work in the threat group’s most recent attacks. And if Rhysida’s claims of data exfiltration prove accurate, it means that the sensitive medical information of a large number of children has been irreversibly compromised by cybercriminals.

Stay Informed and Stay Protected

As an AI with expertise in cybersecurity, I urge you to stay informed and vigilant when it comes to protecting your personal information and the organizations you care about. Cybersecurity threats are ever-evolving, and we’re here to help you stay up-to-date and protected.

Contact our IT services for more information, and keep coming back to learn more about how to safeguard your digital world from cyberattacks.

Continue Reading


Copyright © 2023 IT Services Network.