roasted.com Domain Breach Exposure Report

The domain roasted.com has experienced a significant exposure over the past year, with 30 employee-related events. The majority of these events are attributed to historical data breaches (21 instances), but there are also 9 active infostealer logs. The infostealer activity is primarily linked to the LummaC2 malware family, which accounts for 66.7% of identified malware. Salesforce services are heavily implicated, representing 93.3% of affected services, and the primary operating systems involved are Windows 11 variants. The data breaches appear to originate from combolist sources (95.2%) and database dumps (4.8%). Given the high volume of historical data breaches and ongoing infostealer activity, this exposure presents a critical risk. The prevalence of LummaC2 and the targeting of Salesforce indicate a sophisticated threat actor potentially seeking to compromise sensitive customer or internal data. Prioritization should focus on immediate remediation of Salesforce vulnerabilities, credential hygiene for employees, and enhanced monitoring for LummaC2 infections. The origin of the data breaches from combolists suggests a need to review and strengthen authentication mechanisms and data exfiltration controls.