Cybercriminal ‘Cloud of Logs’: The Emerging Underground Business of Selling Access to Stolen Data

Cybercriminals exfiltrate massive amounts of data when they successfully launch cyberattacks that involve ransomware, botnets, keyloggers, exploit kits, and other malicious components. Additionally, information stolen by criminals might include browsing history, cookies, keystrokes, user credentials, authentication tokens, information about the victim environment that can be used to evade anti-fraud systems, and more.

In our analysis, the amount of data collected by these criminals from the aforementioned attacks exceeds terabytes. However, precisely because of the gargantuan amount of data, it is unlikely that a single threat actor or even a single group of cybercriminals would be able to make full use of it all. In order to milk their opportunities further, cybercriminals have found a way to monetize the excess by letting other cybercriminals rent access to their clouds of logs. Since a lot of the data from such platforms is exfiltrated from compromised end-user and corporate systems and various cloud platforms, such data could be used to conduct further criminal activities.

Customers pay to access these datasets at varying price ranges. Packages that only allow limited access and downloads are in the hundred-dollar ranges. Monthly subscription rates are also offered, with some cybercriminals pricing them within the US$300 to US$1,000 range. For example, Figure 1 shows a screenshot of an advertisement that offers a lifetime membership for US$900.

Figure 1. Monthly access to this dataset, which supposedly contains 1.2 TB logs, is priced at US$350.

Meanwhile, another actor offers a similar service; however, they claim to update their dataset with new stolen accounts on a weekly basis. The service offers a premium subscription for US$300 for the first four customers, while further access is priced at US$1,000.

Figure 2. The seller offers data from companies like Amazon, eBay, and Skrill, among others.

The same seller in Figure 2 also advertises another dataset with about 100,000 logs. Additionally, they say that the distribution of the dataset is limited and that only five copies will be sold. In the underground market, it is common for service providers to limit the number of items that they will sell to customers. Indeed, data sold in a limited number of copies tends to merit a higher price since fewer people can monetize from it. This strategy is similar to that used by sellers in legitimate marketplaces, where premium goods are more expensive than the ones that are produced for mass consumption.

In another instance, we saw an advertisement of a service that guarantees updates of new batches of data ranging from 20,000 to 30,000 logs every one to two weeks. A monthly subscription costs US$1,000, while a semiannual subscription costs US$5,000.

Figure 3. This advertisement guarantees interested customers with new batches of 20,000 to 30,000 logs every one to two weeks.

Here is the breakdown of popular sellers of logs in the underground, including various details of the logs that they sell, and their price ranges.

Based on details that are highlighted by sellers and mentioned by customers, the sizes of logs are often measured in either gigabytes or number of log entries. Some actors advertise the size of collected data stored in plaintext, while others measure the accumulative size of the archived data. This means that the volume of data in 500 GB by one actor could be 50 GB for another actor, because the latter takes into account the size of the data when it is compressed.

Sellers also sometimes advertise data volume by indicating the number of log entries. It is important to note that one log entry is not normally limited to including just a combination of login and password credentials, or even just cookies stolen from the victim host. Rather alarmingly, one log entry can contain so much more, including dozens of credentials for corporate accounts, public email services, social networks, payment systems, banks, and government services. Such log entries also often contain detailed information about the software environment and sensitive data collected from browsers.

Some advertisements indicate the countries or the regions where the data is sourced. Details concerning data type are also often included. For example, data type could refer to whether the data was preprocessed and sorted according to possible monetization paths.

Notably, the price for accessing different datasets varies depending on whether or not the logs had already been used in previous monetization schemes. For instance, two sellers who offer datasets of the same size could price their datasets differently, as the data that had already been monetized in a previous scheme might sell at a lower price.

The content of the datasets, which we will expound on in the succeeding section, typically contains a wide variety of logs, including PII, credit card information, and account credentials that are used for access to cloud services such as those offered by PayPal, Amazon, Google, and more. Figure 4 shows a sample list of some information that can be found in a single log.

Figure 4. A screenshot of the list of information found within a single log

Criminals who buy access to these datasets also vary in their specializations. Some of these criminals primarily focus on carding activities, while others specialize in attacking financial institutions and seek banking credentials. Credentials for accessing cloud platform portals are also sold to those criminals who specialize in selling bulletproof-dedicated services. Such credentials could be used to spawn instances of virtual machines that are then sold in underground markets.

What is the advantage of buying such logs from uniform platforms like the ones that we previously mentioned, compared with the old practice of obtaining these logs individually? The capability to scale operations is one factor. With the use of cloud technologies, criminals are provided more computing power, storage, or bandwidth to optimize their operations.

In addition, with the availability and variance of stolen information in such platforms, criminals only need to search for the data that they need in order to find an opportunity to commit a crime faster; after all, they won’t have to bother with obtaining data themselves anymore. Such data (which includes sensitive account credentials) could potentially leave organizations with unsecure accounts that are vulnerable to attacks. If targeted organizations have weak security in place to begin with, then the chances are even higher that they would not have enough time to detect a breach and employ the appropriate response actions to contain and remediate it. Naturally, the availability and variance of information could also enable criminals to target a larger number of victims.

We analyzed several data samples from forums and online platforms. We also reviewed the advertised features and feedback from buyers. This allowed us to build a more complete picture of what is actually inside the logs that criminals pay to access.

Figure 5. This service provides access to multiple cloud services. On this page, the seller claims to have accumulated more than 3 TB of compressed data.

Many cloud platforms that are used by sellers offer preprocessed and normalized data from a variety of keyloggers, information stealers, and other types of malware. The information is structured and stored inside files. Each file name and/or file path contains the category information of the data. Often, data that is stored in the platform is analyzed first by whoever provides that information. That actor could then extract and use bits of information that they find useful, while the rest of the data would be left in the platform. How the attacker exploits or monetizes the data depends on the attacker’s specialization and skill set. For example, it is very common for attackers to seek credentials to popular services such as eBay, PayPal, Amazon, Qiwi, or cryptocurrency wallets because stolen credentials from these sites allow them to steal money from the linked accounts or to immediately execute certain fraudulent schemes.

Figure 6. This page, which is owned by the same seller in Figure 5, shows the category details of the logs that they offer to potential customers.

Figure 7. This screenshot shows another seller’s offerings, which include varying types of data like passwords, cookies, cards, and wallets. Their webpage also shows the location distribution of the data that they offer.

Other sellers also provide supposed proofs of existence for the accounts that can be accessed using the stolen credentials that they offer. In Figure 8, a seller posts a screenshot of one such account.

Figure 8. To add credence to their offering, a cybercriminal shows a screenshot of the compromised account that is accessible through stolen credentials.

Often, almost all sellers explain the kind of data that is available to potential customers: They clarify the size of the logs, how often the dataset is updated, and the type and quality of data that they have in their platforms. They also often introduce restrictions on how the data and the interface can be used. For example, they strictly prohibit bulk-dumping of a whole dataset and sharing data with a third party or other actors. Violating such restrictions are often punished with account suspension.

As discussed earlier, many sellers also limit the number of people who can access and buy logs. They also implement data watermarking and other tracking methods to enforce their service-level agreements (SLAs). Among these restrictions are fixed quotes on the total number of accessed objects per day, a restriction on the number of files permitted for download, or the implementation of traffic-shaping policies. Other platforms also restrict access to the cloud to one device per account. Some also require private VPN credentials to initiate access to the service.

Among the available samples, we have seen many logs in the format of AZORult Stealer logs. AZORult Stealer logs normally contain victims’ IP addresses, logged credentials to a variety of websites in the form of SOFT (credentials sourced from software) to access the website, HOST, and USER and PASS credentials. In addition, these logs normally contain cookies from browsers and information stored in AutoComplete. Some attackers also know how to effectively use this information to bypass the fraud detections of some financial organizations by creating software environments that match the victim machine.

Figure 9. Example of a log with software and hardware environment information collected from a victim machine

In a sample dataset of 1,000 logs, we identified a total of 67,712 URLs and conducted a short analysis. The chart in Figure 10 shows a breakdown of the top 10 sites with the most stolen credentials based on the log samples that we analyzed.

Figure 10. The distribution of the 10 sites from which most credentials were stolen based on our analysis of a sample dataset. Google tops the list, followed by Facebook, Microsoft, and PayPal respectively.

Figure 11. A screenshot of StealerLogSearcher v1.3 — a tool used to sift through massive amount of logs

StealerLogSearcher v1.3 is a tool that allows cybercriminals to quickly search through massive amounts of data by specifying “strings” of interest and log analysis. The tool allows users to search through the data — regardless of the source of logs — for occurrences of user credentials that match a particular site. It also allows users to provide output in the form of file name, user:password, or URL. Data analyzed by StealerLogSearcher has to be downloaded on the local disk before being analyzed. This tool is frequently used by criminals who are trying to find credentials for particular websites, such as Paypal.com or Qiwi.com.

SorterX, on the other hand, is advertised in the underground as a tool for faster credential-logs processing. However, the tool only supports a number of log formats, and its analyzed folder only contains uncompressed files in subfolders. The version that we reviewed supports log formats generated by AZORult, Predator, Krot, and Smoke malware families. It should be noted that other malware families might adapt some of the widely used formats (such as AZORult’s) and could be supported by this tool as well.

Figure 12. An underground forum member posts about SorterX, a tool that can be used for the faster processing of credential logs.

In underground forums, we also saw a tool that is advertised as capable of importing RDP credentials in .txt format and automating routine tasks for further monetization, including input data format normalization, testing for availability of hosts, collection of the precise geolocation of a victim, credential validation, collection of host fingerprints and software environment, and fingerprinting of network parameters and open ports. RDP credentials are an attractive target for criminals because they are among the major entry points that criminals use when attacking enterprises with ransomware or exfiltrating sensitive data.

Figure 13. The interface of a software advertised as a tool for monetization of RDP credentials

Criminals are also adopting open-source tools for data mining and bulk validation processing of stolen credentials. For example, the open-source tool OpenBullet can be used to verify the validity of stolen credentials. In one of the forum posts that we saw, a user shared that this tool with custom configuration runs checks of stolen credentials from the cloud-gaming platform, Vortex.GG.

Another popular tool is AZORult Analyzer. The name of the tool is revelatory of its purpose: the analysis of AZORult malware logs. The AZORult malware is capable of stealing cookies, browsing history, cookies, ID/passwords, cryptocurrency information, and more.

Indeed, the availability of the aforementioned tools could enable criminals to improve the scale of their operations. By being able to quickly find the data that they need, criminals can conveniently proceed to the subsequent attacks that they might deploy.

Cloud services and technologies enable businesses to be more agile, scalable, and cost-effective. The business of selling access to a cloud of logs does the same, but for cybercrime.

The cloud has equipped illegal businesses operated by criminals with the capability to effectively manage massive datasets and deliver services. By using cloud platforms, criminals are provided with the technology to efficiently mine, process, and host massive amounts of stolen data. As a result of having such stolen, valuable data, they can then conduct their attacks with increased speed when targeting organizations. Furthermore, with the growing business of selling access to stolen, valuable information and the availability of cloud-based tools to help criminals easily find the logs that they need, they are spared both the effort and the time in acquiring the critical data that is necessary for them to proceed with their malicious activities.

As a result, the gap from the time when information is stolen to the time when it is used in an attack is shorter. This could create a blind spot for organizations in particular who have a weak security posture, as they would be left with less time to detect and respond to attacks. Even worse, organizations might not be able to detect an intrusion because the use of legitimate account credentials could help criminals easily evade security solutions.

With operators who have their logs rented out to a diverse customer base of cybercriminals that specialize in different crimes, the potential for using the multitude of stolen data is further maximized for nefarious purposes. For example, some of these cybercriminals could be looking to obtain account credentials for the purpose of stealing money, while others might use these credentials to defraud online shopping sites, just to name a few.