usembassy.gov Domain Breach Exposure Report

The domain usembassy.gov has experienced a significant number of events, with a total of 504 recorded over the period from July 2025 to June 2026. A substantial portion of these events are classified as historical data breaches (423 events) and active infostealer logs (81 events). The timeline indicates a notable surge in employee and client-related events starting in January 2026, with peaks in April 2026. Malware families such as Redline, LummaC2, and Rhadamanthys have been observed. The data breaches are predominantly linked to "Combolist sources" (343 events) and "Database dumps" (80 events), suggesting credential stuffing and potential exfiltration of sensitive information. Targeted services include the main domain and its login/logon pages, with WordPress and Citrix identified as specific service technologies. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of login endpoints, indicates a high risk of credential compromise and potential unauthorized access to sensitive government information. The observed malware families are known for their ability to steal credentials and session cookies. Prioritization should focus on immediate remediation of identified vulnerabilities, strengthening authentication mechanisms, and conducting thorough investigations into the nature and scope of the data breaches and infostealer activity to mitigate further compromise and protect employee and client data.