Daisy Cloud
Daisy Cloud is a prominent cybercrime marketplace and Telegram-based "log cloud" that specializes in distributing and monetizing compromised digital identities. Active since at least 2021, the channel acts as a centralized hub for threat actors to buy and sell massive volumes of fresh data harvested by information-stealing malware (infostealers), such as RedLine and PXA Stealer. By operating on a subscription-based model, Daisy Cloud makes stolen credentials, session cookies, and network access points readily available to downstream attackers, including Initial Access Brokers (IABs) and ransomware syndicates.
How Daisy Cloud Operates within the Cybercrime Ecosystem
Daisy Cloud operates much like a legitimate Software-as-a-Service (SaaS) business, bringing ruthless efficiency to the dark economy. Its operational tactics include:
Telegram-Based Infrastructure: Instead of relying solely on traditional dark web forums, Daisy Cloud uses Telegram channels and automated bots to streamline the delivery of stolen data.
Tiered Subscription Models: The marketplace attracts buyers by releasing free "sample" dumps of older or lower-value logs. Cybercriminals then pay premium subscription fees to access the freshest, highest-value data sets.
Automated Normalization: Raw data exfiltrated from infected machines is often chaotic. Daisy Cloud operators and affiliated bots parse and organize this data, making it highly searchable so buyers can target specific industries, geographies, or platforms.
Evasion and Persistence: To bypass moderation and law-enforcement takedowns, operators frequently rotate channel names, use mirrored accounts, and maintain backup groups to ensure uninterrupted service for their subscribers.
Types of Compromised Data Traded on Daisy Cloud
The logs distributed through Daisy Cloud represent a severe threat to corporate security because they provide the exact materials needed to bypass traditional perimeter defenses. Commonly traded data includes:
Session Cookies and Tokens: Active browser cookies and Primary Refresh Tokens (PRTs) that allow attackers to hijack live sessions and bypass Multi-Factor Authentication (MFA).
Corporate Credentials: Usernames and passwords for VPNs, cloud environments, financial platforms, and Single Sign-On (SSO) portals.
Cryptocurrency Wallets: Private keys and wallet data extracted directly from infected personal and corporate devices.
System and Device Fingerprints: Detailed metadata about the infected machine, including operating system details, IP addresses, and installed applications, which helps attackers craft highly targeted follow-up exploits.
Frequently Asked Questions About Daisy Cloud
What is a Telegram Log Cloud?
A Telegram log cloud is a dedicated channel or group on the Telegram messaging app used by cybercriminals to aggregate, share, and sell large datasets (logs) harvested by infostealer malware.
What malware families feed data into Daisy Cloud?
Daisy Cloud primarily distributes data stolen by widespread infostealer variants. While RedLine Stealer is heavily associated with the marketplace, data from other malware families, such as Lumma, Vidar, and PXA Stealer, also frequently appear in its daily dumps.
Why are threat actors moving to Telegram instead of the dark web?
Telegram offers cybercriminals ease of use, mobile accessibility, and the ability to automate sales and data delivery through custom bots. It lowers the barrier to entry compared to navigating encrypted dark web forums, allowing threat actors to reach a broader audience of potential buyers quickly.
How does Daisy Cloud enable ransomware attacks?
Ransomware syndicates and their affiliates purchase fresh corporate access logs from Daisy Cloud. By using the stolen VPN credentials or active session cookies, they can bypass perimeter security and MFA, establish a foothold inside the network, and eventually deploy ransomware without having to force their way in.
How ThreatNG Neutralizes Infostealer Threats and Telegram Log Clouds
The industrialization of cybercrime has led to the rise of sophisticated Initial Access Brokers (IABs) who rely heavily on information-stealing malware to harvest credentials, session cookies, and Primary Refresh Tokens (PRTs). When this stolen data is distributed through illicit dark web marketplaces and Telegram log clouds, organizations face an unprecedented risk of network compromise. ThreatNG provides the necessary "Outside-In" intelligence to detect and neutralize these compromised identities before they are weaponized.
Continuous Monitoring and External Discovery
ThreatNG operates as a frictionless engine that secures the external attack surface. It performs purely external, unauthenticated discovery using no connectors or internal agents.
Continuous Visibility: ThreatNG continuously monitors the external attack surface, digital risk, and security ratings for all monitored organizations.
Shadow IT Detection: It identifies unknown subdomains, rogue cloud accounts, and forgotten marketing sites that internal tools cannot see.
Example Scenario: If an employee uses an unmanaged personal device to access corporate environments and inadvertently downloads an infostealer, internal systems remain blind. ThreatNG's continuous external discovery serves as a vital perimeter walk, identifying exposed external assets that an attacker might target using the newly stolen session tokens.
Intelligence Repositories (DarCache)
ThreatNG transforms chaotic dark web data into structured, actionable intelligence through its Data Aggregation Reconnaissance Cache (DarCache).
DarCache Infostealer: This specialized repository continuously parses, normalizes, and sanitizes the dark web to find analyzed infostealer logs containing usernames, passwords, cookies, and session tokens belonging to an organization.
DarCache Rupture: A comprehensive repository tracking all organizational emails associated with data breaches and compromised credentials.
DarCache Vulnerability: A strategic risk engine that fuses data from the National Vulnerability Database (NVD), Exploit Prediction Scoring System (EPSS), Known Exploited Vulnerabilities (KEV), and Proof-of-Concept exploits to prioritize real-world threats.
Example Scenario: When an infostealer exfiltrates a financial controller's session token to a dark web log cloud, DarCache instantly indexes this data. Security teams can simply enter their domain into the interactive search to reveal compromised usernames and the specific log source that attributed them.
In-Depth Investigation Modules
ThreatNG uses granular investigation modules to uncover specific attack vectors that could be exploited by adversaries with stolen credentials.
Sensitive Code Exposure: This module discovers public code repositories and identifies leaked secrets, including AWS Access Key IDs, Stripe API keys, Slack Webhooks, and database configuration files.
Subdomain Intelligence: ThreatNG analyzes subdomains for takeover susceptibility by identifying dangling DNS records pointing to inactive third-party services. It also scans for exposed remote access services like SSH, RDP, and VNC.
Technology Stack Discovery: This module uncovers nearly 4,000 technologies comprising a target's external attack surface, cataloging everything from Cloud Infrastructure to Identity and Access Management platforms.
Example Scenario: If an IAB acquires an employee's credentials, ThreatNG's investigation modules ensure that the organization already knows exactly which public-facing administrative portals, remote access services, or code repositories are exposed and vulnerable to unauthorized access.
Precision External Assessment
Instead of generating flat lists of raw data, ThreatNG translates its findings into boardroom-ready A-F security ratings based on specific susceptibility profiles.
Breach & Ransomware Susceptibility: Evaluates an organization's risk by combining compromised credentials found in DarCache with exposed ports, private IPs, and subdomain vulnerabilities.
Non-Human Identity (NHI) Exposure: Quantifies the vulnerability to threats originating from high-privilege machine identities, such as leaked API keys and service accounts, which are frequently harvested by infostealers.
Data Leak Susceptibility: Rates exposure by uncovering open cloud buckets, compromised credentials, and known vulnerabilities.
Example Scenario: An organization discovers that its Breach & Ransomware Susceptibility rating has dropped to an "F." By reviewing the assessment, executives can clearly see that the grade is directly tied to a recently discovered cluster of compromised credentials matching their domain, prompting immediate remediation.
Actionable Reporting and DarChain Attack Path Mapping
ThreatNG eliminates alert fatigue by correlating technical findings into a strategic narrative.
Comprehensive Reporting: The platform delivers Executive, Technical, and Prioritized reports that map findings to major frameworks such as PCI DSS, HIPAA, GDPR, and NIST.
DarChain Attack Path Modeling: DarChain correlates technical exposures to map out the precise exploit chain an adversary might follow.
Example Scenario: Instead of handing analysts a disconnected list of 5,000 IPs and a separate alert about a stolen password, DarChain connects the findings. It maps a specific compromised email directly to a vulnerable, exposed API, handing security teams a clear blueprint of the impending attack path.
Empowering Complementary Solutions
ThreatNG serves as the definitive external intelligence layer, significantly enhancing the effectiveness of complementary security solutions.
Governance, Risk, and Compliance (GRC) Platforms: GRC platforms govern the authorized state of an organization in accordance with internal policies. ThreatNG acts as a satellite feed, continuously scanning the external environment to detect unmanaged shadow IT and policy violations, feeding the observed reality directly into the GRC framework.
Continuous Control Monitoring (CCM): CCM solutions monitor the efficacy of internal controls on known assets. ThreatNG closes the visibility gap by feeding the CCM system newly discovered, unwired entry points—such as forgotten cloud instances—so they can be brought under management.
Breach and Attack Simulation (BAS): BAS platforms simulate sophisticated attacks to test defenses. ThreatNG expands the scope of these simulations by feeding the BAS engine dynamic lists of exposed APIs, dev environments, and leaked credentials, ensuring the platform tests the forgotten side doors that real attackers target.
Cyber Risk Quantification (CRQ): CRQ solutions calculate financial risk using statistical probability. ThreatNG feeds real-time behavioral facts into the CRQ model, dynamically adjusting likelihood variables based on actual indicators of compromise, such as active dark web chatter and brand impersonations.
Frequently Asked Questions
What is Legal-Grade Attribution?
Legal-Grade Attribution is the capability delivered by ThreatNG's proprietary Context Engine, which utilizes multi-source data fusion to iteratively correlate external technical findings with decisive legal, financial, and operational context. This definitely proves whether an exposed asset or compromised credential belongs to the organization, eliminating the guesswork and wasted time associated with false positives.
How does ThreatNG interact with Managed Security Service Providers (MSSPs)?
ThreatNG acts as the elite "Spotter" for the MSSP's "Sniper". While the MSSP possesses the tools to execute remediation, they often lack full visibility. ThreatNG scans the digital horizon and provides the MSSP with the legally attributed target and the mapped exploit chain, allowing analysts to execute surgical, high-impact remediations.
Can ThreatNG detect session token theft caused by infostealers?
Yes. ThreatNG's DarCache Infostealer module is specifically designed to detect compromised session tokens and Primary Refresh Tokens (PRTs). It achieves this by continuously parsing and archiving the dark web marketplaces where Initial Access Brokers trade this harvested data, alerting organizations to the theft before adversaries can use the tokens to bypass MFA.
