ex.ua Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting both employees and clients, with a substantial volume of historical data breaches and active infostealer logs. The data suggests a broad compromise affecting user credentials and potentially sensitive information, with a high concentration of events originating from Ukraine. The prevalence of infostealer malware families like Redline, LummaC2, and Rhadamanthys points to credential harvesting as a primary threat vector. The targeted services, including login pages and mail portals for ex.ua, suggest a focus on compromising access to user accounts and communication platforms. The leak repository classification highlights "Combolist sources" and "Database dumps" as the primary sources of leaked data, indicating a large-scale credential stuffing or brute-force attack scenario, likely exacerbated by previous data breaches.