webmoney.ru Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting webmoney.ru, primarily driven by a large volume of historical data breaches (89.5%) and active infostealer logs (10.5%) over the period of July 2025 to June 2026. The data breaches are overwhelmingly sourced from combolist sources, suggesting compromised credentials. Infostealer activity is dominated by Redline, LummaC2, and Rhadamanthys malware families, which are known for exfiltrating sensitive information. The exposure affects a substantial number of clients (113,100) and a smaller number of employees (155). Targeted services include signup and login pages for wallet and merchant functionalities, indicating a focus on financial transaction accounts. Given the high volume of data breaches and the prevalence of infostealer malware targeting financial services, this incident should be prioritized as critical. The primary remediation focus should be on credential hygiene, including mandatory password resets for all affected employees and clients, enhanced multi-factor authentication implementation, and user education on phishing and credential compromise risks. Continuous monitoring for infostealer activity and further data exfiltration is also recommended. The geographical breakdown shows a diverse range of affected countries, with Ukraine, Bangladesh, and Algeria being most prominent, alongside Russia and the UK.