Cyberattacks have become both more sophisticated and more routine, and corporate credentials are a constant target. On the anonymous "dark web" in particular, information stolen from services around the world is actively bought and sold. In this article, we report on an investigation we carried out to shed light on how this threat actually looks.
Purpose of this dark web investigation
The goal of the investigation was to check whether information linked to companies in Japan had leaked onto the dark web and was sitting there for anyone to access.
It was carried out as part of our proactive threat intelligence work using our in-house dark web monitoring tool.
Initial discovery (by our dark web monitoring tool)
During a threat scan by our dark web monitoring tool, a suspicious listing turned up on the dark web.
That prompted a deeper investigation across several cybercriminal forums and marketplaces.
What we found on the dark web forum "cra_____.sh"
The investigation found a thread on a dark web forum called cra_____.sh offering a large data dump for sale, under the following title:
“⚡️ 0-1-BILLION-VIP-ULP-PRIVATE- ⚡️-ALI$$-TXTBA$$E ”
▶ (Note) This is a typical thread title on dark web forums. It means roughly "A list of up to one billion VIP login ID and password pairs [exclusive] [rare] [text format]."
The post also mentioned regions such as "Japan," suggesting that Japanese companies and individuals may be among those affected.
cra_____.sh
/Thread-⚡☁BILLION-VIP-ULP-PRIVATE-⚡️-ALIEN-TXTBASE-☁️
How we analyzed and filtered the leaked data
To gauge the potential scope of the damage, we downloaded the .txt files attached to the thread and analyzed their contents with basic text processing.
Step 1: Extract .co.jp domains
First, we extracted entries containing ".co.jp" domains, which are widely used by Japanese companies.
▶ Note: We cannot show the images in full, but you can see that a large number of entries were extracted.
Step 2: Detect /admin paths
Next, we extracted entries containing /admin paths, which suggest access to administrator portals.
▶ Note: We cannot show the images in full, but the extracted entries are highly likely to include access rights to admin panels.
Cross-checking against combo lists (leaked credentials)
To verify how serious the extracted data was, we cross-checked it against "combo lists (lists of leaked email address and password pairs)."
The result confirmed that thousands of email address and password pairs on ".co.jp" domains had leaked. They most likely originate from past data breaches.
What is the dark web, and why is it dangerous?
The dark web is the part of the internet that ordinary search engines do not index.
For the basics of the dark web, see the article below.
Understanding the Deep Web and the Darknet: A Practitioner's View on Engaging Safely
It can only be reached with dedicated tools such as the Tor Browser, and illegal trading and information exchange take place there all the time.
There are also many real examples of marketplaces where credentials are bought and sold.
What is traded on the dark web
- Stolen credentials, malware, remote access
- Hacking tools, exploit code, leaked databases
- Ransomware-as-a-Service (RaaS)
- Phishing kits and manuals for 2FA bypass tools
Anyone can attack: an era in which "a data breach can happen to anyone"
With these tools and leaked data in circulation, you no longer need to be an expert to launch an attack.
These inexperienced attackers are called "script kiddies," and they attack using tools built by others.
Even a script kiddie can:
- Buy leaked credentials cheaply
- Try logins with automated tools (credential stuffing)
- Use phishing site templates
- Use guides for bypassing 2FA and fake ID tools
Why information on Japanese companies is a particular target
Based on this investigation and industry trends, these are the reasons Japanese companies are especially likely to be targeted:
- Legacy systems are still widely in use (manufacturing, logistics and other sectors)
- Investment in threat intelligence and monitoring is low by international standards
- Heavy reliance on external vendors widens the attack surface
- Limited ability to act on threat intelligence that is mostly in English (language and cultural barriers)
- Little visibility into, and no structure for tracking, whether credentials have leaked
This investigation confirmed the fact that highly sensitive credentials, including admin panel URLs, are already in circulation.
Summary
This investigation made clear that data leakage is no longer hypothetical but an ongoing threat.
On top of that, the means to exploit it are cheap and easy to obtain.
For recommended software to defend against ransomware attacks that exploit leaked credentials, see the article below.
Best Ransomware Protection Software Compared (2026): A Complete Guide for Individuals and Businesses
If even a script kiddie can log in with a credential list costing 1,000 yen,
how much damage could professional attackers and ransomware groups do?
What should companies do right now?
How should companies respond to the serious threat this investigation revealed? Below are concrete measures that IT staff and executives should put into practice right away.
1. Deploy and enforce multi-factor authentication (MFA)
This is the most effective way to make sure a leaked ID and password alone cannot be used to log in. Deploy MFA on every critical system reachable from outside, including internal systems and cloud services, and make sure every employee uses it.
2. Strengthen and manage your password policy
"Password reuse" is the single biggest reason one leak lets attackers into other systems. Mandate password length and complexity, require periodic changes, and ban reuse. Introducing a secure password manager is also effective.
3. Ongoing security training for employees
Regular training that raises every employee's security awareness, such as how to spot phishing scams and why password management matters, is essential.
4. Apply the principle of least privilege
Give employees only the minimum access rights they need to do their jobs. If an account is ever taken over, this keeps the damage to a minimum.
5. Make use of proactive threat intelligence
Use tools such as a dark web monitoring service to continuously watch whether your company's information is being traded on the dark web. Detecting a leak early lets you act before the damage spreads.
Do you know your company's data leak risk?
As this article has shown, many companies face the fact that they do not know when, where or how much of their information has leaked.
Even if you think "we're fine," preparations for an attack may be under way without your noticing.
CyberCrew's "Dark Web Monitoring Service" uses specialist analysts and proprietary monitoring tools to detect threat information related to your company across the vast expanse of the dark web as early as possible, and advises you on concrete countermeasures.
We have summarized the monitoring companies that can catch leaks early in the article below.
No more living in fear of invisible threats. Why not start by getting an accurate picture of where your company stands?
Glossary
Explanations of the technical terms used in this article.
| Term | Explanation |
|---|---|
| Dark web | A highly anonymous area of the internet that can only be reached with special browsers such as Tor. It is often used to buy and sell illegal goods and stolen information. |
| Threat intelligence | Knowledge and insight gained by collecting and analyzing information about cyberattacks so that an organization can anticipate, assess and counter the threats it faces. |
| Combo list | A large list of email address and password pairs leaked from various services in the past. It is abused in credential stuffing attacks. |
| Script kiddie | An inexperienced attacker without advanced technical skills who attempts cyberattacks using tools created by others. |
| Credential stuffing | An attack method that mechanically tries ID and password pairs leaked from one service to log in to another, using combo lists and similar sources. |
| Ransomware-as-a-Service (RaaS) | A business model in which ransomware developers provide their tools and infrastructure, for a fee, to people who want to carry out attacks. |
