Full Report
Combolists and ULP files circulate on the dark web as new leaks, but most of what they contain was stolen years earlier and recycled many times over.
Analysis Summary
# Tool/Technique: Combolists and ULP (User:Login:Password) Files
## Overview
Combolists and ULP files are structured datasets containing large volumes of stolen credentials (typically email/username and password pairs). These files are primarily used by threat actors to facilitate automated credential stuffing and account takeover (ATO) attacks. While often marketed on the dark web as "new" or "fresh" leaks, they are frequently composed of recycled data from historical breaches, rebranded to increase their perceived value.
## Technical Details
- **Type**: Technique / Data Asset
- **Platform**: Cross-platform (Web applications, RDP, VPNs, SaaS)
- **Capabilities**: Automated authentication attempts, credential recycling, marketing deception.
- **First Seen**: Circulating for over a decade; persistent in cybercriminal underground.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1589.001 - Gather Victim Identity Information: Credentials]
- [T1110.001 - Brute Force: Password Cracking]
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- [T1110.004 - Brute Force: Credential Stuffing]
## Functionality
### Core Capabilities
- **Mass Authentication Testing**: Designed to be fed into automated "checkers" or "bruters" to verify account validity across multiple services.
- **Data Aggregation**: Merges credentials from various disparate breaches into a standardized `login:password` or `user:email:password` format.
- **Stripped Formatting**: Unlike raw database dumps, combolists remove metadata (hashes, salts, internal IDs) to focus strictly on plaintext or easily crackable credentials.
### Advanced Features
- **Session Hijacking Integration**: Some advanced "logs" (often categorized with ULP) include session cookies to bypass Multi-Factor Authentication (MFA).
- **Branding/Recycling**: Threat actors rename and repackage old datasets (re-birthing) to maintain high reputation scores on underground forums and drive sales.
## Indicators of Compromise
*Note: As these are data files rather than executable malware, indicators are behavioral or artifact-based.*
- **File Names**: Frequently follow patterns like `[Country]_[Service]_Fresh_2024.txt`, `ULP_Combo_Mega.txt`, or `Private_Cloud_Logs.zip`.
- **Behavioral Indicators**:
- High volumes of failed login attempts from a single IP or a distributed proxy network (Credential Stuffing).
- Successful logins from unusual geographic locations or mismatched User-Agents.
- Rapid spikes in "Forgot Password" requests.
## Associated Threat Actors
- **Access Brokers**: Use combolists to find entry points into corporate networks to sell to ransomware groups.
- **Script Kiddies / Low-level Fraudsters**: Use automated tools to hijack retail, streaming, or gaming accounts for resale.
- **Credential Stuffing Botnet Operators**.
## Detection Methods
- **Behavioral Detection**: Monitoring for high-frequency authentication failures and the use of known proxy/Tor exit nodes.
- **Credential Screening**: Comparing user-submitted passwords against known leaked databases (e.g., Have I Been Pwned or internal Threat Intelligence feeds).
- **Dark Web Monitoring**: Tracking mentions of company domains within newly released combolists and ULP files on forums and Telegram channels.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA)**: Implementation of hardware keys or TOTP (Time-based One-Time Passwords) to invalidate the utility of stolen passwords.
- **Password Policies**: Enforcing the use of unique passwords to prevent "cross-site" credential stuffing success.
- **Rate Limiting**: Implementing CAPTCHAs and account lockout policies after consecutive failed attempts.
- **Device Fingerprinting**: Identifying and flagging logins from unrecognized devices or browser environments.
## Related Tools/Techniques
- **Credential Stuffing**: The primary method of utilizing combolists.
- **Account Takeover (ATO)**: The end goal of utilizing these files.
- **Stealer Logs**: More comprehensive data packages (often from RedLine or Vidar malware) that include combolists plus browser cookies and system snapshots.