Key Points

• Account credentials are highly valued by threat actors as they provide easy access to critical data. They are typically compromised through data breaches, malware (primarily infostealers), and user negligence.
• Stolen credentials are traded on cybercriminal forums, specialized log marketplaces, and messaging apps like Telegram. Telegram tends to be favored by adversaries for its user-friendly interface and perceived privacy. For proactive protection, ReliaQuest’s GreyMatter Digital Risk Protection (DRP) searches for leaked credential mentions in these locations and alerts customers upon detection.
• With these credentials, threat actors can perform account takeover, credential stuffing, and valid account abuse. GreyMatter Response Playbooks such as Reset Password and Terminate Session can help contain credential abuse incidents and protect company assets.

Credentials—like usernames, email addresses, and passwords—often find their way into the wrong hands through various means, from malware and phishing attacks to simple user negligence. For threat actors, these leaked credentials are a golden ticket, granting them easy access to infiltrate networks and critical data. This can lead to account takeover, identity theft, financial loss, and data breaches. Credential abuse impacts all sectors and regions, as threat actors cast a wide net to maximize their success.

This report provides detailed insights into how leaked credentials are obtained, traded, and used by threat actors. This is especially timely given Telegram’s new policy to share user data with law enforcement—a move that could seriously disrupt the credential abuse cycle—and a recent law enforcement crackdown on the information-stealing malware (aka infostealer) “RedLine”. As a key platform for trading leaked credentials, this change could shake up the entire cyber threat landscape.

To help harden your defenses against these threats, we’ll also explore how ReliaQuest combats credential abuse through continuous monitoring, advanced detection capabilities, and proactive incident response measures.

Stage 1: Stealing Your Credentials

Credentials can be compromised through data breaches, user negligence, phishing attacks, infostealers, and weak passwords. In Q3 2024, credential exposure alerts made up a striking 75% of GreyMatter Digital Risk Protection (DRP) alerts across our customer base, revealing the extensive threat posed by compromised credentials. For perspective, marked document, the next highest alert type, accounted for only 9% of total alerts. This highlights the critical need to understand how credentials are compromised to better protect your environment. Let’s break down the two most common methods and explore case studies showcasing these techniques.

Infostealers Operating Under the Radar

Infostealers gather personal, financial, and business data—including passwords, credit card numbers, and browsing history—from compromised systems. They often infiltrate systems through phishing emails or compromised websites and operate quietly in the background, making them hard to detect. Infostealers use various sophisticated techniques to extract credentials. Some use keylogging to capture everything a user types, particularly passwords and credit card details. Others use form grabbing to steal login credentials and payment information by intercepting the data submitted in web forms before it’s encrypted by the browser. They also use methods such as screen capturing, browser session hijacking, and email hijacking to obtain sensitive information.

Infostealers are on the rise: From Q3 to Q4 2023, we saw a 30.5% rise in marketplace listings for “stealer logs.” This uptick indicates the effectiveness of infostealers like “LummaC2,” RedLine, and “Raccoon” in harvesting sensitive data, making them a major concern for organizations worldwide. Infostealers are favored by threat actors because of their stealthy credential extraction—often, stolen credentials end up on cybercriminal marketplaces before businesses even realize they’ve been compromised.

In late October 2024, international law enforcement took down the infrastructure used to run the RedLine and “Meta” infostealers and revealed charges against one of RedLine’s developers and admins. We ranked RedLine as the second most common infostealer in 2023, seeing a 44% jump in listings from Q3 to Q4, just behind LummaC2. As of now, it appears RedLine’s activity has halted. However, it’s likely that RedLine will resume in the short-term future (one-three months); law enforcement takedowns are usually a temporary annoyance for cybercriminals, and they often manage bounce back quickly to continue their operations.

To keep passwords secure, avoid storing credentials in browsers where they’re more easily accessible to attackers. Instead, use dedicated password managers. Security teams should also monitor outbound traffic for communication with command-and-control (C2) infrastructure to catch compromised machines early and prevent further data loss.

In June 2024, ReliaQuest investigated a compromised user device at a manufacturing organization. An employee fell for a phishing email that led to a malicious domain, resulting in a suspicious ZIP file containing an LNK file being downloaded. When executed, the file attempted to connect to a remote IP address. Further investigation revealed attempts to execute PowerShell commands and establish connections to external domains, indicating infostealer compromise. The initial ZIP file was proactively deleted from the host to prevent further spread.

For effective remediation, we recommended blocking the identified indicators of compromise (IoCs), isolating and re-imaging the host, conducting a full antivirus scan, rotating the user’s credentials, and revoking any open sessions. This incident highlights the importance of robust email filtering, blocking suspicious domains, and educating users about phishing risks.

Automated incident response would have further enhanced remediation. For instance, GreyMatter’s Automated Response Playbooks could have contained the threat even faster by automatically quarantining the suspicious file immediately upon download.

Even the Best Defenses Face Data Breach Risks

Data breaches occur for all sorts of reasons, including software vulnerabilities, inadequate security measures, and human error. In targeted breaches, adversaries steal vast amounts of sensitive information like usernames, passwords, email addresses, and other personal data. They then sell this data on cybercriminal forums, marketplaces, and other illicit channels, enabling other threat actors to acquire credentials in bulk.

But not all breaches are malicious—accidental breaches can be just as damaging. These can arise from incorrect use of email features like cc or bcc, failing to redact sensitive information when sharing documents, sharing data with the wrong clients, or, as in the case study below, uploading sensitive data to publicly accessible locations. While many believe they wouldn’t be so careless, accidental breaches are surprisingly common. Between 2019 and 2023, 29% to 35% of breaches reported to the UK Information Commissioner’s Office (ICO) were due to human error.

Often, data breaches affect more than just the direct target. Many organizations share data with third-party vendors, partners, or service providers. If any of these entities are compromised, the breach can expose data from multiple organizations, amplifying the scale and impact of an attack. This is particularly problematic because organizations can’t control the security measures that their third-party associates have in place, adding an outside risk factor to their own data security.

In June 2024, we investigated a retail sector incident involving the unintended exposure of confidential data on VirusTotal, a legitimate online tool for analyzing suspicious files and URLs. A user uploaded a document to VirusTotal, likely to check if it was malicious. Unfortunately, this made the document available as a downloadable artifact to premium VirusTotal users, thereby inadvertently exposing confidential data. During our investigation, we found the initial file on VirusTotal and discovered an additional file on the same site that allegedly contained a leaked credential for the customer. We promptly shared this with the customer, who confirmed the file did not contain valid data, allowing for swift resolution.

This case study underscores the importance of stringent data-handling and sharing practices, as well as comprehensive security awareness training to prevent accidental data exposures. Although it’s not possible to control the data policies of other entities, as a best practice, organizations should educate employees on the risks of using public tools to analyze files and implement strict protocols to safeguard sensitive information.

Stage 2: Trading Credentials in the Underground

Threat actors often sell or freely distribute stolen credentials on multiple platforms, including cybercriminal forums, specialized logs marketplaces, and messaging apps like Telegram. These platforms make stolen login details widely accessible, enabling a wide array of threat actors—regardless of their goals or technical skills—to exploit them.

The Persistent Dark Market of Telegram

Telegram is a favorite among threat actors for selling and leaking credentials thanks to its user-friendly interface and reputation (until recently) for privacy and security. For buyers, Telegram offers easy access to numerous sellers. For sellers, the lack of account approval processes and interaction with forum moderators makes it an attractive option.

Despite Telegram’s limited search functionality, finding channels that distribute or sell leaked data is relatively easy. With third-party services like TGStat, which catalogs Telegram channels, you can find multiple groups focused on leaked credentials through keyword searches. Cybercriminal forum users often post lists of Telegram channels involved in sharing or selling stolen data (see Figure 1), and these third-party services frequently advertise their offerings on forums. The abundance of such channels underscores Telegram’s popularity for cybercriminal activities.

Figure 1: An XSS user lists stealer log Telegram channels in response to a request from another user

On September 23, 2024, Telegram’s founder and chief executive, Pavel Durov, announced the removal of more “problematic content” and a more proactive approach to complying with government requests. This came weeks after his arrest in France on charges of failing to act against criminals using the app. Durov stated that Telegram had removed illegal goods from its search feature and updated its terms of service to share infringers’ details with authorities. Despite these changes, credential leak services still thrive on the platform. This situation is likely to persist, although the landscape remains highly changeable. While some controversial political groups are leaving Telegram, credential leak channels appear unaffected.

Operators of these channels likely perceive little risk of law enforcement action, partly due to the channels’ obscured origins. Even if Telegram complies with law enforcement requests for information, effective responses will likely require coordinated international action. Many operators work in regions like Russia, where local law enforcement is less likely to intervene as long as they don’t target Russian users.

An analysis of posts on Russian-language cybercriminal forums XSS and Exploit between October 8 and October 15, 2024, showed that almost all posts containing the keyword “Telegram” included contact details. This indicates that threat actors are undeterred by recent events and still using the platform. Among the 112 posts that we analyzed, only one user, “0nebob,” explicitly showed hesitation to use Telegram following Durov’s arrest, stating, “prefer to use tox since telegram is now sharing user information.” This continued use means that Telegram still poses a significant threat to businesses whose credentials are stolen and sold there.

Figure 2: An XSS user expresses concern over Telegram’s announcement  

The sheer volume of Telegram channels complicates tracking efforts. Credential re-sharing is rampant, with credentials rapidly spreading across channels, increasing the risk of widespread exposure. Additionally, the high turnover of Telegram channels, in contrast to more stable marketplaces like Russian Market (which we talk about later), makes monitoring Telegram a complicated and time-intensive process. This dynamic landscape makes it challenging for businesses to manage and mitigate the dissemination of their stolen credentials.

To stay ahead of these evolving threats, GreyMatter DRP continuously monitors a wide range of Telegram channels for mentions of leaked credentials and other proprietary data. It provides alerts when matches are found against client assets. This proactive approach helps organizations swiftly identify compromised credentials and secure accounts, preventing further malicious activities such as spam distribution or business email compromise (BEC).

Inside the Credential Marketplace on Cybercriminal Forums

Credentials, both paid and free, are offered on many cybercriminal forums. Databases of email and password combinations are often listed alongside other types of breached data, such as patient data from health care facilities. Generalist forums such as XSS, Exploit and the English-language BreachForums regularly host these listings. The sources of the breached data are typically not disclosed, although some users on BreachForums frequently claim responsibility for specific hacks. This drives up the data’s sale price, especially if the user is known for releasing fresh data.

In contrast, specialized cybercriminal forums focus almost exclusively on providing email-password login credentials. Two notable examples are the English-language AggressorDB and the Russian-language UFOLABS. Both sites offer free credential leaks for download but rarely disclose the sources. Often, login credentials are recycled and repeatedly reposted, meaning even old breaches continue to pose a threat as the same credentials get exposed again and again.

GreyMatter DRP ingests leak posts from these sites and alerts customers if their assets are compromised. This allows organizations to quickly identify and respond to potential threats, ensuring that compromised credentials are promptly rotated and accounts are secured to prevent unauthorized access.

In October 2024, we downloaded a breach from BreachForums that allegedly contained 132 million records of compromised data from a single enterprise, including passwords for 10 million accounts. Our investigation revealed that several of our customers were mentioned in the dataset, posing potential operational threats from account abuse or credential stuffing. We swiftly notified all affected customers, providing them with relevant data and guidance on next steps.

Several customers were surprised to learn they were affected by the breach, as they had no dealings with the targeted organization. This highlights a common issue with forum leaks—data is often aggregated from various sources and may not match the description provided by the poster. As a precaution, we recommended rotating the credentials of potentially affected users. Our continuous monitoring of select dark-websites and timely customer communications ensured that customers could verify the risk to their sensitive data and manage the breach’s impact effectively.

Russian Market: The Go-To for Stolen Credentials

Among specialized cybercriminal marketplaces, Russian Market stands out for selling logs of compromised credentials. Unlike other platforms, it provides detailed information about the origins of its leaked data, including the type of infostealer used, and the internet provider and location of the theft. No log comes for free on Russian Market, with each log typically costing $10. Russian Market reflects the professionalism of Automated Vending Cart (AVC) sites, offering a large volume of credentials and a streamlined purchasing process without buyer-seller interaction. Threat actors favor Russian Market for its convenience, consistent pricing, and reliable supply of fresh data.

Figure 3: Example of a log sales post on Russian Market

Posts advertising logs for sale display the affected email domains, but the associated passwords are only revealed upon purchase. ReliaQuest collects data from Russian Market and makes the publicly available content of listings visible to our DRP customers. This insight helps identify potential compromised credentials and determine if accounts with elevated privileges are at risk.

Stage 3: Exploiting Stolen Credentials

Stolen credentials give threat actors a powerful way to infiltrate networks and carry out a range of malicious activities. The scale of campaigns exploiting stolen credentials can be immense. This was demonstrated by “UNC5537,” a financially motivated threat actor who targeted Snowflake customer database instances using credentials obtained from infostealer malware. In this campaign, UNC5537 compromised multiple Snowflake instances, exfiltrated sensitive data, and attempted to extort victims, affecting around 165 organizations.

Assessing the impact of credential abuse on customer incidents is complex. Some MITRE techniques are almost exclusively associated with credential abuse, like Cloud Accounts, T1078.004, while others, such as Internal Spearphishing, T1534, can be part of the credential abuse cycle but also point to other unrelated malicious activities. In Q3 2024, true-positive customer incidents across all sectors highlighted credential abuse as a major concern. Taking a broad view of potentially relevant MITRE techniques, credential abuse could be involved in up to 36% of true-positive alerts. A more conservative estimate, focusing only on techniques specifically linked to credential abuse, gives a figure of 7%. Either way, these statistics indicate a serious threat. Two of the most common methods of exploiting stolen credentials are valid account abuse and credential stuffing, which we will explore in more detail in this section.

Abusing Valid Accounts for Network Intrusion

Once threat actors gain access to a network using stolen credentials, they can move laterally to compromise other hosts and servers. Using legitimate credentials helps their activity blend in with normal user behavior, reducing the chances of early detection and increasing dwell time within the network.

This tactic is popular among many threat actors. Advanced persistent threat (APT) groups like China-linked “APT40,” use valid credentials to conduct cyber espionage operations and discreetly access sensitive data. Similarly, financially motivated threat actors also carry out their malicious activity widely through valid account abuse. For instance, “Scattered Spider” has been observed using valid accounts to conduct multifactor authentication (MFA) fatigue attacks. In these attacks, attackers repeatedly attempt to log into accounts using valid credentials, causing a flood of MFA notifications to the legitimate user. Frustrated by the relentless notifications, the user may eventually approve the request, mistaking it for a system error or a genuine sign-in attempt. This tactic allows attackers to crudely bypass MFA and gain unauthorized access to a network, highlighting the varied ways valid accounts can be exploited for network entry.

Once inside the network, adversaries can carry out malicious activities while posing as legitimate users, making it challenging to detect system or network anomalies. This can lead to broader system access, where attackers might steal sensitive data, deploy ransomware, or perform other malicious actions. With access to user accounts and their permissions, attackers can maintain persistence and move laterally in the network, inflicting significant damage. For more on how this attack type affects organizations and practical mitigations, read our valid account credential abuse blog.

In August 2024, ReliaQuest investigated a compromised user account at a health care organization. The incident began when an attacker impersonated a legitimate user to report login issues and request a password reset via the organization’s IT service desk. For validation, the attacker provided a Social Security Number (SSN) and an emergency code. Shortly after, the real user called back, denying the initial request. This prompted another credential rotation and subsequent password lockout.

Our investigation revealed logins from anomalous IP addresses linked to brute-force attacks. In the user’s Workday account, we found attempts to modify account details, likely to redirect pay checks, traced back to another malicious IP address. We linked this incident to a social engineering campaign targeting health care organizations to reset MFA credentials and access banking information. The attacker likely obtained the SSN from a previous data breach, highlighting the risk of using static information for identity verification.

Given that this activity was likely a targeted campaign against the customer, we recommended implementing stricter controls for help-desk requests. Specifically, we advised revoking active sessions during credential rotation/password resets, considering additional controls such as video verification by management, and using device-based and location-based conditional access controls. This incident underscores the importance of dynamic identity verification methods and the need for enhanced security measures in help-desk procedures to combat impersonation attempts.

When One Password Opens Many Doors

Credential stuffing is a technique where threat actors use credentials stolen from unrelated breaches to access target accounts through credential reuse. This method takes advantage of the common habit of reusing passwords across personal and business accounts and using business accounts to sign up for personal accounts on websites. Adversaries employ automated tools to test vast numbers of username and password pairs across different login forms, hoping for a match. Despite causing many authentication failures and account lockouts, credential stuffing remains popular because of its potential success. Automated tools let threat actors take a scattergun approach until they hit an easy target.

Credential stuffing also allows attackers to use information from data leaks to reset passwords for business accounts. Using security questions, recovery emails, or other personal information found in breached data, threat actors can attempt password resets even if the passwords aren’t reused. This technique lets attackers compromise business accounts and subsequently access sensitive information or send internal phishing emails from compromised accounts.

How ReliaQuest Tackles Credential Abuse

GreyMatter DRP plays a pivotal role in combatting credential abuse. It continuously monitors a wide range of sources such as dark-web forums, specialized marketplaces, and messaging apps for leaked credentials and other sensitive data. When compromised credentials are identified, DRP alerts customers, enabling them to quickly rotate account credentials, secure the accounts, and mitigate potential threats.

Integrating GreyMatter Response Playbooks into your incident response plan can streamline and simplify handling potential credential abuse incidents. For the fastest remediation, implement automated incident response with the following GreyMatter Automated Response Playbooks to automatically contain threats as soon as they are detected. This approach reduces your mean time to contain (MTTC), significantly minimizing potential damage. Alternatively, set GreyMatter Response Playbooks to “RQ Approved” and let our analyst team handle remediation on your behalf, expediting the process. Certain Response Playbooks like “Isolate Host” can be set to require phone approval to avoid business disruption.

Reset Password: Resets the password of a compromised account after suspicious activities like multiple failed login attempts or geographically anomalous logins. This prevents attackers from using the account to launch further attacks or access sensitive information. This playbook can be run automatically to reset the password as soon as the alert fires, reducing MTTC.

Terminate Session: Closes all active sessions for a compromised account, forcing attackers to re-enter the account’s password. When run automatically alongside Reset Password, it ensures attackers are immediately locked out and unable to reuse the compromised credentials to access the account again.

Isolate Host: Disconnects a specified host from the network, restricting its communications to the technology console. This action prevents further lateral movement or data exfiltration if a host is accessed without authorization.

Block IoC: Adds specified IoCs to the ban list when suspicious activities, like remote logins from high-risk countries or multiple failed login attempts, are identified, this playbook. Blocking these IoCs prevents further interactions with known threats, mitigating risks from credential abuse.

What’s Next in Credential Abuse

Credential abuse remains a cornerstone of cybercriminal activity, making it crucial for organizations to understand how credentials are compromised, traded, and exploited. Incidents like the UNC5537 campaign against Snowflake instances demonstrate just how damaging credential abuse can be, emphasizing the urgent need for robust security measures.

Looking ahead, the landscape of credential abuse is poised for change. With personal devices being increasingly used for both work and personal activities, the risk of credential bleed is rising. This dual usage creates new vulnerabilities, particularly in mobile password managers that may not receive timely updates. Attackers are likely to exploit Common Vulnerabilities and Exposures (CVEs) in these apps, taking advantage of the less stringent update practices on personal devices.

Even more transformative is the potential shift from traditional passwords to “passkeys,” which use public key cryptography to enhance security. Passkeys eliminate the need to share secret credentials with websites, using cryptographic keys to authenticate logins without transferring sensitive information. While this technology promises improved security, widespread adoption is unlikely in the medium term (12–18 months). During this period, traditional credential abuse methods will continue to pose significant risks. Even as passkeys become more common, threat actors may evolve their tactics to find new ways around these defenses.

To help our customers navigate the multitude of threats associated with the credential abuse lifecycle, GreyMatter and GreyMatter DRP work in tandem to deliver comprehensive protection. GreyMatter provides advanced detection capabilities and Automated Response Playbooks to fortify defenses. Meanwhile, the DRP solution continuously monitors dark-web forums, specialized marketplaces, and messaging apps like Telegram, enabling organizations to quickly spot compromised credentials and secure accounts.

By staying vigilance and implementing robust security measures, organizations can protect their critical assets and maintain a strong security posture amidst evolving cyber threats. Adapting and enhancing security practices will be essential to counter the dynamic tactics of cybercriminals looking to steal, trade, or exploit credentials.