Malware

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Published

9 months ago

January 20, 2024

Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.

In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.

It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.

At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.

This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.

Understanding Leaked Credentials

To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.

Tier 1 Leaked Credentials

Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.

For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.

Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.

Defending Against Tier 1 Leaked Credentials

Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.

Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.

Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.

The Special Case of Combolists

Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.

Screenshot of combolist
Source: IT Services

These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.

Tier 2 Leaked Credentials

Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.

We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:

A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.

These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.

These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.

**Screenshot of the information stealer logs can contain, including cookies, passwords, and other sensitive information**
*Source: IT Services*

Tier 3 Leaked Credentials

This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.

Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.

**Screenshot from Telegram of a malware store**
*Source: IT Services*

Defending Against Tier 3 Leaked Credentials

Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.

Multi-Factor Authentication Isn’t a Silver Bullet

Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.

Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.

The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.

Concerned about Credentials? We Can Help

IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.

Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.

Check out our free trial.

Sponsored and written by IT Services.

Up Next

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Don't Miss

Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars

Click to comment

Malware

USDoD Hacker Responsible for Massive National Public Data Breach Captured in Brazil

Brazilian authorities have arrested a hacker accused of stealing 223GB of sensitive data from the US Department of Defense (DoD). The hacker, known as “Zambrius,” sold the data on the dark web and was also involved in other cybercrimes.

Published

5 hours ago

October 21, 2024

zendzipr

In a dimly lit room filled with computer screens displaying sensitive data, a person in a hoodie is captured by an armed officer. The individual is reportedly connected to the National Public Data Breach incident, raising suspicions of being a USDoD hacker.

Imagine waking up one day to find your personal information plastered all over the internet. Well, that nightmare became a reality for millions of Americans when notorious hacker USDoD, also known as EquationCorp, breached National Public Data and the FBI’s InfraGard, leaking sensitive information online. But this cybercriminal’s reign of terror has come to an end, as Brazil’s Polícia Federal recently arrested USDoD in “Operation Data Breach.”

USDoD’s Infamous Data Breaches

USDoD gained notoriety for his high-profile data breaches, often stealing data and leaking it on hacking forums while taunting his victims. His breaches include the FBI’s InfraGard, a threat information sharing portal, and National Public Data, where the personal data and social security numbers of hundreds of millions of US citizens were leaked online.

However, things took a turn for the worse for USDoD when he targeted cybersecurity firm CrowdStrike and leaked the company’s internal threat actor list.

How USDoD Was Caught

After leaking CrowdStrike’s list, Brazilian publisher Techmundo received an anonymous report created by CrowdStrike that allegedly identified, or doxed, the threat actor, revealing he was a 33-year-old Brazilian named Luan BG. Strangely, USDoD confirmed that CrowdStrike’s information was accurate in an interview with HackRead and said he was currently living in Brazil.

With this information, Brazil’s Polícia Federal (PF) announced his arrest in Belo Horizonte/MG. “The Federal Police launched Operation Data Breach on Wednesday (16/10), with the aim of investigating invasions of the systems of the Federal Police and other international institutions,” reads the PF’s press release.

The Importance of Cybersecurity

This arrest serves as a reminder of the importance of cybersecurity. As individuals and businesses, we must stay vigilant and proactive in protecting our sensitive data. But you don’t have to navigate the world of cybersecurity alone.

Our IT Services team is here to help you protect your data and ensure your digital safety. From implementing robust security measures to providing guidance on best practices, we’ll work with you to keep your information secure.

Stay Informed and Stay Safe

Knowledge is power, and staying informed about the latest cybersecurity threats and best practices is the first step in keeping your data safe. We encourage you to reach out to our team and keep coming back to learn more about how to protect yourself and your business from cybercriminals.

Malware

Cisco Probes Intrusion as Stolen Data Emerges for Sale on Cybercriminal Platform

Cisco is investigating a potential breach after a hacker claimed to have stolen 200GB of sensitive data. The company is working to determine the authenticity of the claim and assess any potential impacts on its customers. Protect your network with Cisco’s integrated security solutions and stay informed with the latest cybersecurity updates.

Published

1 day ago

October 20, 2024

zendzipr

Recently, we received information that Cisco, a leading IT company, is investigating a possible data breach after a threat actor claimed to have stolen sensitive data and put it up for sale on a hacking forum. Don’t worry, we’ve got you covered with the latest updates on this situation.

What’s going on with Cisco?

Cisco confirmed that they are looking into these claims and have launched an investigation to assess the situation. A Cisco spokesperson stated, “We are aware of reports that an actor is alleging to have gained access to certain Cisco-related files.” The investigation is still ongoing.

This all started when a notorious threat actor going by the name “IntelBroker” claimed that they, along with two accomplices called “EnergyWeaponUser” and “zjj,” had breached Cisco on October 6, 2024, and made off with a significant amount of developer data from the company. The stolen data apparently includes GitHub projects, GitLab projects, SonarQube projects, source code, hardcoded credentials, customer documents, and much more.

What has been leaked?

IntelBroker shared samples of the alleged stolen data, which includes a database, customer information, various customer documentation, and screenshots of customer management portals. However, they did not provide any details about how they obtained the data.

It’s worth noting that back in June, IntelBroker was involved in selling or leaking data from several other companies, such as T-Mobile, AMD, and Apple. Those attacks were believed to have been carried out by targeting a third-party managed services provider for DevOps and software development. It’s not clear yet whether the Cisco breach is related to these previous incidents.

What’s the current status of the investigation?

As of now, Cisco is continuing to investigate the reports and has engaged law enforcement to assist in their efforts. So far, they have found no evidence of a breach in their systems. If any confidential customer information is confirmed to have been obtained by the threat actor, Cisco has stated that they will notify the affected customers.

In conclusion, it’s essential to stay vigilant and keep up-to-date on the latest cybersecurity news and threats. You can trust us to provide you with the most recent information and help you navigate the ever-evolving world of cybersecurity. Don’t hesitate to contact us to learn more about how to protect your organization, and keep coming back for more updates on this and other cybersecurity topics.

Malware

Game Freak Confirms Massive Breach: Stolen Pokémon Data Exposed Online

Game Freak, the developer behind Pokémon, has confirmed a security breach after stolen data leaked online. The leaked data includes information on unreleased games, potentially impacting both the company and fans. Game Freak is working to address the situation and strengthen their security measures to prevent future incidents.

Published

2 days ago

October 19, 2024

zendzipr

An animated character in an orange outfit and hat stands beside a fox-like creature with large ears in a sunlit forest, reminiscent of a Game Freak creation.

Imagine spending years of your life working on a top-secret project, only for it to be stolen and leaked online. That’s what happened to Game Freak, the Japanese video game developer behind the wildly popular Pokémon series, in August 2024. And now, we’re learning just how extensive the damage was.

A Digital Heist in the World of Pokémon

Game Freak has been at the forefront of the Pokémon gaming world since 1996, when they released Pokémon Red and Blue for the Nintendo Game Boy. Since then, they’ve produced countless titles for various Nintendo platforms, as well as for iOS and Android devices.

But in August, things took a turn for the worse. Screenshots of source code and development builds for upcoming Pokémon games started appearing on leak sites and channels like Discord, Reddit, and X. While Game Freak didn’t acknowledge the leak of the game data, they did confirm something even more concerning: the personal information of their workforce, contractors, and former employees was stolen in the cyberattack.

Damage Control and Apologies

In a machine-translated notice, Game Freak stated, “We deeply apologize for any inconvenience and concern this may have caused to all concerned parties.” They went on to explain that the leaked information included full names and company email addresses. While this doesn’t put people at risk for identity theft, it does leave them vulnerable to phishing and targeted brute-forcing attacks.

Game Freak is working to contact those affected by the incident individually, but they published the notice on their site because not everyone can be reached. On a positive note, it seems that Pokémon player data hasn’t been impacted. Game Freak has completed a detailed investigation of the breached servers and implemented security measures to prevent similar incidents in the future.

Not an Isolated Incident

Game Freak isn’t the only gaming company to fall victim to a cyberattack recently. Earlier this month, Canadian video game developer Red Barrels warned its community that an attack could cause delays on patches and additional content for existing Outlast games and upcoming titles. The Nitrogen ransomware group later claimed responsibility for the attack, boasting that they had stolen 1.8 TB of confidential data from Red Barrels.

As for the attack on Game Freak, no one has claimed responsibility yet. But the fact remains that this is a stark reminder of the vulnerability of even the most successful companies in the gaming industry.

What You Can Do to Help

As fans and consumers, it’s essential for us to stay informed and vigilant about cybersecurity. By keeping up-to-date with the latest news and best practices, we can help protect ourselves and the companies we love from these devastating cyberattacks.

But you don’t have to do it alone. Our IT Services team is here to help you navigate the ever-evolving landscape of cybersecurity. Don’t hesitate to contact us with any questions or concerns you might have. And remember to keep coming back for the latest information and advice on staying secure in the digital world.