tass.ru Domain Breach Exposure Report

The telemetry indicates a significant exposure of 344 historical data breaches and 69 active infostealer logs related to tass.ru, affecting 156 employees and 257 clients over the period of July 2025 to June 2026. The data breaches primarily originate from "Combolist sources" (76.5%) and "Database dumps" (23.5%). Malware families associated with the infostealer logs include Redline (24.6%), Rhadamanthys (2.9%), and LummaC2 (2.9%). Targeted services are predominantly tass.ru and its subdomains, including login pages. Geographically, the United States, Germany, and Venezuela show the highest incidence of related activity. The high volume of historical data breaches and active infostealer logs, coupled with the involvement of common infostealer malware, presents a critical risk of credential compromise and further data exfiltration. Prioritization should focus on immediate remediation of identified vulnerabilities on tass.ru login pages and associated services, comprehensive credential hygiene for affected employees and clients, and enhanced monitoring for suspicious activity originating from or targeting the identified geographical regions. The prevalence of combolist sources suggests a need to address potential credential stuffing attacks.