Sekoia Launches Service to Monitor Criminal Sources for Exposed Credentials
Summary
Sekoia Digital Risk monitors criminal forums, stealer logs, and other sources for exposed organizational credentials, sessions, and data, combining those findings with Sekoia threat intelligence to help security teams investigate and respond.
Key points
- The service matches customer-supplied domains, usernames, brand terms, and executive names against data from stealer logs, criminal forums and markets, ransomware leak sites, and Telegram channels.
- Alerts can include exposed passwords or session cookies, criminal-channel mentions, brand or executive exposure, and source context.
- Sekoia says the service can be combined with its threat intelligence to connect exposures with malware families, threat actors, and relevant detection rules.
- Underground data collection is provided by Flare, which Sekoia says covers more than 150 million stealer logs, 127,000 Telegram channels, and 390 cybercrime forums.
- The service does not reset passwords, revoke sessions, or submit takedown requests; customers handle those response actions.
- Sekoia Digital Risk is available to Sekoia Intelligence customers, with pricing based on the number of employees monitored.
Article Details
- Event Type
- Sekoia launched Sekoia Digital Risk, an exposure-monitoring product that matches customer identifiers against data from stealer logs, underground forums and markets, ransomware leak sites, and Telegram channels.
- Impact
- The product alerts customers when credentials, sessions, corporate data, or brand-related information appear in monitored sources, helping them investigate and respond. It does not reset passwords, revoke sessions, or file takedown requests. The article also describes credential-related breaches affecting Snowflake customers, Uber, CircleCI, and Okta.
Threat Actors
LAPSUS$An attacker in the Uber incident claimed to be part of Lapsus$; the article does not confirm that affiliation.Scattered SpiderGroup the article says was most associated with attacks on Okta tenants in 2023.ShinyHuntersExtortion operation the article says followed the Snowflake intrusions.UNC5537Tracked group the article associates with the Snowflake intrusions and the subsequent ShinyHunters extortion operation.
Malware
Lummamalware, the distribution networks, the traffers who spread it and the logs they produce. Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest everyRaccoonnetworks, the traffers who spread it and the logs they produce. Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every saved password, everyRedLinethe distribution networks, the traffers who spread it and the logs they produce. Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every savedVidarnetworks, the traffers who spread it and the logs they produce. Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every saved password,
Vendors
FlareThe collection behind this is powered by Flare, whose researchers and automated collection cover more than 150 million stealer logs, 127,000 Telegram channels and 390 cybercrime forums. We chose to partner rather thanMandiantSnowflake started reporting data theft. Ticketmaster. Santander. AT&T. Advance Auto Parts. By the time Mandiant finished its investigation, at least 165 organisations were affected and hundreds of millions of recordsSekoiaWith Sekoia Intelligence, we gave you half the picture. Here's the other half.SnowflakeIn the spring of 2024, customers of the cloud data platform Snowflake started reporting data theft. Ticketmaster. Santander. AT&T. Advance Auto Parts. By the time Mandiant finished its investigation, at least 165VerizonThose logs are packaged and sold on Telegram, often for a few dollars, sometimes for free. The 2025 Verizon Data Breach Investigations Report found that 88% of web application attacks involved stolen credentials,
Products
AWSfound hard-coded admin credentials on an internal network share and ended up with access to Uber's AWS, Google Workspace, Slack and bug bounty systems. Our team wrote about Lapsus$ earlier that year, when theGoogle Workspacehard-coded admin credentials on an internal network share and ended up with access to Uber's AWS, Google Workspace, Slack and bug bounty systems. Our team wrote about Lapsus$ earlier that year, when the group wasOkta3. Okta, October 2023Sekoia Digital RiskSekoia Digital Risk helps identify exposed credentials and track where they surface.Sekoia IntelligenceWith Sekoia Intelligence, we gave you half the picture. Here's the other half.Slackadmin credentials on an internal network share and ended up with access to Uber's AWS, Google Workspace, Slack and bug bounty systems. Our team wrote about Lapsus$ earlier that year, when the group was already buyingSnowflakeIn the spring of 2024, customers of the cloud data platform Snowflake started reporting data theft. Ticketmaster. Santander. AT&T. Advance Auto Parts. By the time Mandiant finished its investigation, at least 165