Floating on Cloud Crime: Subscription-based credential markets on Telegram

Floating on Cloud Crime: Subscription-based credential markets on Telegram

Speakers: Liv Rowley

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=qBxaR3OuaZQ

Overview

In "Floating on Cloud Crime: Subscription-based credential markets on Telegram," Liv Rowley shines a light on an evolving and highly accessible facet of the cybercrime ecosystem: the proliferation of Underground Clouds of Logs (UCLs). These markets, predominantly hosted on Telegram, offer stolen credentials and other sensitive data on a subscription basis, making it remarkably easy for aspiring and seasoned criminals alike to acquire the raw materials for various forms of fraud. Rowley's talk meticulously dissects the operational mechanisms, advertising strategies, and resilience of these Telegram-based platforms, emphasizing their public visibility and the low barrier to entry they present.

The presentation underscores the significant shift in cybercrime markets from traditional dark web forums to mainstream messaging applications like Telegram. This transition, facilitated by Telegram's features and its founders' historical stance on user privacy, has created a fertile ground for the sale of data harvested by information-stealing malware (info-stealers). Rowley's research reveals a sophisticated, yet openly advertised, economy where stolen data is packaged and sold, highlighting the urgent need for defenders to understand this threat landscape.

This talk is crucial for anyone involved in cybersecurity, from threat intelligence analysts and incident responders to security awareness educators. It provides a detailed look into the "middle layer" of cybercrime, where the output of initial compromise (stolen logs) is monetized before being used for downstream attacks like account takeover, credit card fraud, or even initial access for ransomware. Understanding these markets is vital for developing effective defensive strategies and disrupting the broader criminal supply chain.

Background

▶ Watch: Understanding the 'Underground Clouds of Logs' ecosystem (2:40)

To comprehend the phenomenon of Underground Clouds of Logs (UCLs), it's essential to first establish a foundational understanding of Telegram and the nature of malware logs. Telegram, a messaging platform founded in Russia, boasts over 1 billion downloads and hundreds of millions of monthly active users globally. While its origins lie in Russia and former Soviet countries, it also has a significant user base across India, other parts of Asia, Latin America, and Western countries like the US, UK, and France. Its appeal lies in its robust messaging capabilities, supporting both peer-to-peer communications and large group/channel interactions, making it a versatile platform for both legitimate and illicit activities.

The core commodity sold within UCLs are malware logs, specifically those generated by info-stealers (information-stealing malware). These malicious programs, once infecting a victim's device, exfiltrate a wide array of sensitive data back to the malware operators. This data typically includes login credentials (usernames, passwords), credit card information, API keys, and details about installed software. These logs represent a treasure trove for criminals, enabling various forms of fraud and further compromise.

The concept of Underground Clouds of Logs, a term Rowley attributes to Group IB, describes the complete ecosystem:

1. An info-stealer infects a victim, collects data, and reports it back to the malware operator.
2. The malware operator then uploads this stolen information to a cloud file-sharing service (e.g., Mega).
3. From there, they advertise access to these logs on public Telegram channels, often on a subscription-based model.

From a criminal's perspective, this process is streamlined and accessible. A buyer can pay a subscription fee (e.g., $50 USD for a week) to gain access to a cloud folder containing thousands of fresh logs or be added to a private Telegram group where logs are shared as downloadable files. Once the subscription expires, access is revoked. This model significantly lowers the barrier to entry for cybercriminals, providing a readily available supply of compromised data that can be leveraged for a myriad of illicit activities, including ransomware attacks (as illustrated by the Australian Signals Directorate's graphic), account takeover fraud, credit card fraud, and tax refund fraud. The shift to Telegram for these markets signifies an evolution in the accessibility and operational dynamics of the cybercrime landscape.

Key Findings

▶ Watch: The 'free logs' business model for attracting buyers (10:00)

Liv Rowley's research into Telegram's subscription-based credential markets uncovered several critical findings that illuminate the structure, resilience, and operational nuances of these criminal enterprises.

Firstly, the ease of discovery and access to these markets is striking. Contrary to initial assumptions, these groups are not hidden deep within the dark web but are often public-facing Telegram channels with thousands of subscribers. They frequently use terms like "cloud" explicitly in their names or advertisements, making them straightforward to identify. For instance, Omega Cloud, a prominent provider, boasts thousands of subscribers in its public channel.

Secondly, these UCL providers demonstrate significant persistence and resilience. They are "very rarely taken offline by Telegram," and even when channels are blocked, the impact is minimal. This is due to their operational model, which involves interconnected webs of channels. A single UCL provider might operate 2 to 10 Telegram channels, each serving a specialized function—a main advertising channel, a chat group, a channel for "combos" (credential lists), and even direct contacts for administrators. This redundancy ensures that if a few channels are taken down, the business can continue largely uninterrupted. Rowley cited an example where a channel was blocked, and a new one was created "less than 24 hours later."

Thirdly, the pricing structure and market differentiation among UCLs are complex. While a direct comparison of prices proved challenging due to varying quality, volume, and reputation, Rowley did note that a week of access could cost around $86 NZD, with lifetime access ranging from $300 to $5,000 USD. The wide variation reflects factors like the reputation of the group, the perceived quality and volume of logs, and even bonus offerings like a "little rat" (Remote Access Trojan) included with a month's subscription. The sheer volume of subscribers was also a key metric, with one outlier group having 19,000 subscribers, demonstrating a significant public interest in these illicit products.

Fourthly, Rowley identified specific info-stealer families explicitly mentioned by UCL providers as the source of their logs. Raccoon, Redline, and Luma were frequently referenced, with Rise, Stealc, and Var also making appearances. This direct attribution by criminals themselves provides valuable intelligence for threat researchers.

Fifthly, free logs are a common marketing tactic. The majority of UCLs offer free log samples, allowing potential buyers to "play around with them" before committing to a subscription. This business model, likened to a pie shop offering samples, makes sense. However, Rowley also observed instances where UCLs shared logs explicitly sourced from other UCLs (e.g., Mooncloud sharing logs tagged "@Omega"), suggesting either "skiddy behavior" or a strategy to draw any interested party into their channel, regardless of the log's original provenance.

Sixthly, UCLs often promote other cybercrime products alongside log subscriptions. Examples included advertisements for "B cryptochecker" (an account-checking tool for cryptocurrency accounts) and offers for OpenBullet configs (configurations for credential-stuffing tools), indicating a broader ecosystem of interconnected tools and services.

Finally, a significant finding was the pervasive use of bots in the workflow of more sophisticated UCLs. These bots automate the purchasing process, from selecting subscription tiers and payment methods (e.g., Ethereum via Cryptobot) to processing invoices. This hands-off, organized approach distinguishes Telegram from other platforms and contributes to its continued appeal for cybercriminals, even after a Telegram founder's arrest and stated willingness to cooperate with law enforcement. Rowley observed a correlation between bot usage and the presence of Russian language components in advertisements, hinting at a higher level of sophistication in these operations.

Technical Deep Dive

▶ Watch: How bots automate credential market transactions on Telegram (12:30)

The operational model of Underground Clouds of Logs (UCLs) on Telegram represents a streamlined, subscription-based cybercrime supply chain, leveraging common technologies and user-friendly interfaces to facilitate illicit trade. At its core, the process begins with the deployment of information-stealing malware (info-stealers). These malicious programs are designed to compromise a victim's device and exfiltrate a wide array of sensitive data, including login credentials, credit card details, API keys, and system information. Rowley specifically highlighted prominent info-stealer families such as Raccoon, Redline, and Luma, alongside others like Rise, Stealc, and Var, as primary sources for the logs.

Once an info-stealer successfully compromises a victim and reports its findings, the malware operator aggregates these stolen logs. The next critical step involves uploading this raw, stolen data to a cloud file-sharing service, with Mega being a frequently observed platform. This serves as a centralized repository for the vast quantities of exfiltrated information. The choice of a cloud service provides scalability and ease of distribution, as operators can simply share links to folders rather than hosting the data themselves.

The distribution and sales channel is where Telegram plays its pivotal role. UCL providers establish public Telegram channels to advertise their offerings. These channels, often overtly named (e.g., "Omega Cloud"), serve as storefronts, attracting thousands of potential buyers. Advertisements are often slick, detailing the volume of "fresh logs" available daily (e.g., 3,000-5,000 logs), pricing for various subscription durations (e.g., weekly, monthly, lifetime), and accepted payment methods, typically various cryptocurrencies.

Upon a buyer's interest, access to the logs is granted through one of two primary mechanisms:

1. Direct Cloud Link: The buyer receives a link to the cloud file-sharing folder (e.g., on Mega) containing the logs.
2. Private Telegram Group: The buyer is added to a dedicated private Telegram group where logs are shared as downloadable files. Once the subscription period ends, the buyer is typically removed from this group.

A key technical differentiator for more sophisticated UCLs is the integration of bots into their Telegram workflow. Rowley provided a detailed walkthrough of an interaction with the "WaterCloud product bot" and "Cryptobot." This automated system allows for a highly hands-off sales process:

• A buyer initiates a chat with the UCL's product bot.
• The bot presents subscription options (e.g., "cloud of logs," "ulp text list" or combo list).
• The buyer selects a subscription duration and price (e.g., "one month $230").
• The bot prompts for a payment method (e.g., Ethereum, Bitcoin, Litecoin).
• Upon selection, the bot often redirects to a specialized cryptocurrency payment bot, such as Cryptobot.
• Cryptobot then generates an invoice, prompting the buyer to deposit the required cryptocurrency into their Cryptobot account to complete the transaction.

This bot-driven automation not only streamlines sales and payment processing but also enhances organization and efficiency for the criminal operators. It minimizes direct human interaction, reducing the risk of operational errors and potentially increasing transaction speed. The observation that groups using bots often featured Russian language components in their advertisements suggests a level of technical sophistication and potentially organized structure.

Furthermore, the UCL ecosystem is characterized by interconnected networks of Telegram channels. Instead of a single point of failure, a provider like Omega Cloud might operate multiple channels: a main advertising channel, a separate chat channel for community interaction, a channel dedicated to "combos" (lists of stolen credentials), and direct contact information for an administrator. This distributed architecture provides significant resilience against takedowns. If Telegram blocks one channel, others remain operational, and new channels can be spun up rapidly (Rowley noted a new channel appearing "less than 24 hours later" after a ban). This modular and redundant design is a critical aspect of their technical resilience.

Demo / Proof of Concept

▶ Watch: Banned one day, back online the next (18:30)

While the speaker, Liv Rowley, initially intended to include a live video demonstration of the bot interaction, she opted for screenshots due to concerns about reliability during the presentation. This effectively served as a detailed walkthrough of a simulated purchasing process, illustrating the functionality of Telegram bots within the UCL ecosystem.

The demonstration focused on a specific UCL provider named WaterCloud. Rowley walked the audience through the steps a potential buyer would take to acquire a subscription:

1. Initiating Interaction: The process began by interacting with the "WaterCloud product bot" on Telegram, typically by hitting a "start" button.
2. Subscription Selection: The bot presented various options, including "buy subscriptions" and "check out information about your own profile." Selecting "buy subscriptions" led to further choices, such as "cloud of logs" (the private UCL offering) or a "ulp text list" (a combo list).
3. Duration and Pricing: Upon selecting "cloud of logs," the bot offered different subscription durations and their corresponding prices, for example, "one month $230."
4. Payment Method: After confirming the desired subscription, the bot prompted the user to choose a deposit method from a list of various cryptocurrencies, such as Ethereum.
5. External Bot Integration: The payment process was then seamlessly handed off to another specialized bot, in this case, "Cryptobot." The user would interact with Cryptobot, which then displayed an invoice from "WaterCloud Inc." for the specified amount (e.g., $230 USD worth of Ethereum).
6. Payment Confirmation/Funds Check: Cryptobot would then check the user's balance within their Cryptobot account and instruct them to upload funds if insufficient.

This screenshot-based demonstration effectively illustrated the highly automated and hands-off nature of transactions within these sophisticated Telegram-based credential markets. It showcased how cybercriminals leverage Telegram's bot API to manage sales, handle payments, and streamline their illicit operations, minimizing direct human involvement and increasing efficiency.

Defensive Implications

▶ Watch: Key takeaways: Telegram's role and criminal specialization (19:40)

The detailed insights into Telegram's subscription-based credential markets presented by Liv Rowley carry significant defensive implications for individuals, organizations, and law enforcement agencies. Understanding this landscape is crucial for developing proactive and reactive cybersecurity strategies.

Firstly, info-stealer detection and prevention must be a top priority. Since UCLs are entirely dependent on data harvested by info-stealers (like Raccoon, Redline, Luma, Rise, Stealc, and Var), robust endpoint detection and response (EDR) solutions are essential. Organizations should deploy advanced antivirus and EDR tools capable of identifying and blocking known info-stealer behaviors, including process injection, credential harvesting, and data exfiltration attempts. Regular security awareness training for employees is also critical, emphasizing the dangers of phishing, suspicious downloads, and unverified software installations, which are common vectors for info-stealer delivery.

Secondly, credential hygiene and multi-factor authentication (MFA) are paramount. The primary commodity of UCLs is stolen login credentials, which directly fuel attacks like credential stuffing and account takeover fraud. Organizations must enforce strong, unique passwords across all accounts and, more importantly, implement MFA wherever possible. MFA significantly reduces the impact of stolen credentials, as even if a password is compromised, the attacker still needs a second factor to gain access. Monitoring for suspicious login attempts, especially from unusual geographic locations or IP addresses, should also be a standard practice.

Thirdly, proactive threat intelligence is invaluable. Security teams should actively monitor public Telegram channels and dark web forums for mentions of new UCLs, info-stealer variants, and associated tactics, techniques, and procedures (TTPs). Insights into the specific malware families used, pricing models, and advertised features can inform defensive priorities and allow organizations to anticipate potential threats. While direct takedowns of Telegram channels are challenging and often ineffective due to their interconnected nature and ease of recreation, intelligence gathering can help identify compromised accounts, track threat actors, and understand the evolving threat landscape.

Fourthly, organizations must consider the risk to their supply chain and API keys. Info-stealers often exfiltrate not just user credentials but also API keys and information about installed software. This data can be used to gain unauthorized access to cloud services, internal systems, or third-party applications, creating significant supply chain vulnerabilities. Robust asset management, regular auditing of API keys, and implementation of least privilege principles are essential to mitigate this risk.

Finally, the resilience of these Telegram markets, particularly their use of bots for automation and interconnected channel networks, suggests that traditional "takedown" approaches are insufficient. Law enforcement and cybersecurity entities need to focus on disrupting the broader ecosystem. This includes targeting the developers and distributors of info-stealers upstream, as well as the individuals and groups engaged in downstream fraud using the purchased logs. Collaborative efforts between industry, law enforcement, and platform providers (like Telegram) are necessary, though the historical challenges in securing cooperation from Telegram's end remain. Emphasizing the criminal consequences of both selling and buying these logs, beyond just platform terms of service violations, could also be a strategic direction.

Key Takeaways

• Telegram as a Primary Cybercrime Market: Telegram has evolved into a significant and easily accessible platform for the trade of stolen credentials, moving away from more traditional dark web marketplaces.
• Bots Enhance Criminal Sophistication: The integration of bots for automated sales, payment processing (e.g., via Cryptobot), and user management distinguishes more sophisticated UCL operations on Telegram, offering a hands-off and organized approach for criminals.
• High Resilience to Takedowns: UCLs employ interconnected networks of Telegram channels and the ability to rapidly create new channels, making traditional takedown efforts largely ineffective and ensuring business continuity.
• Low Barrier to Entry for Criminals: The subscription-based model and public accessibility of these markets significantly lower the barrier for individuals to acquire stolen data, fueling various forms of downstream fraud like account takeover and credit card theft.
• Info-Stealers are the Foundation: The entire UCL ecosystem relies on data harvested by information-stealing malware (e.g., Raccoon, Redline, Luma), highlighting the critical need for robust endpoint security and user awareness to combat these initial infection vectors.
• Specialization in the Cybercrime Ecosystem: The existence of UCLs demonstrates the ongoing specialization within the cybercrime world, where different actors focus on specific parts of the attack chain, from malware development to data aggregation and eventual fraud.

About the Speaker(s)

Liv Rowley is a security researcher whose work focuses on understanding and dissecting various facets of cybercrime. Based on her presentation, she has a keen interest in the evolving methodologies and platforms utilized by criminal actors, particularly in the realm of credential markets and information-stealing malware. Her analytical approach aims to shed light on the operational dynamics and resilience of these illicit ecosystems, contributing valuable insights to the cybersecurity community.