Terabytes of Data Stolen From Cloud-Based Collaboration Tools, Researchers Warn
Dozens of organizations that use real-time content collaboration platforms appear to have had their data stolen after they failed to protect cloud accounts using multifactor authentication.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
A major broker of stolen access credentials for organizations, who uses the handle “Zestix,” appears to have used information-stealing malware to amass corporate credentials for those tools and sell them to others. The broker also appears to have stolen terabytes’ worth of data from firms that left their cloud-based collaboration software exposed, says threat intelligence firm Hudson Rock.
Stolen data advertised by Zestix includes 2TB of military police health data records, 77 gigabytes of aircraft manuals, mass transit schematics, litigation and other legal information, various types of patient health data and other medical records, and sensitive maps used by public utilities. Apparent victims include the Massachusetts subsidiary of the world’s largest rolling stock manufacturer, which builds trains for the Massachusetts Bay Transportation Authority and LA Metro, as well as Indonesia’s main satellite operator. Also on the list is a platform used to manage medical and financial details for multiple U.S. healthcare facilities, and a major technology integrator in Colombia.
Hudson Rock said all of this Zestix-amassed data appears to have been stolen from organizations that use one of three types of cloud-based collaboration software: ShareFile, owned by Massachusetts-based Progress Software; ownCloud, which is developed by Kiteworks; and Nextcloud. Both ownCloud and Nextcloud are open source and can be self-hosted for personal use, although businesses typically access the software by paying for an enterprise version, in this case respectively from California-based Kiteworks and Germany-based Nextcloud Enterprise.
These tools typically get billed as being secure, cloud-based document workflow and file-sharing platforms. A common factor that appears to link data theft victims is a lack of multifactor authentication to safeguard cloud access (see: Multifactor Authentication Shouldn’t Be Optional).
In a statement, a Progress Software spokesperson distanced the company from the hacks. “These credentials were stolen via malware on client machines,” the spokesperson said. “Progress continues to emphasize the importance of utilizing multifactor authentication as a widely recognized control to help mitigate the risk of credential-based attacks.”
“In general, we think that these breaches show once again the importance of two-factor authentication, which we recommend all enterprise customers and community users to enable,” Nextcloud spokesman Jos Poortvliet told Information Security Media Group.
“Similarly, it is key for administrators to keep up with maintenance updates of their servers and use our security scanner. For critical data, enterprises should always deploy Nextcloud Enterprise to ensure the highest degree of security and compliance,” he said.
Kiteworks did not respond to a request for comment.
Zestix appears to have used infostealers such as RedLine, Lumma and Vidar to infect corporate or personal devices and obtain valid credentials for accessing an organization’s instance of the collaboration software, Hudson Rock said. Rather than just selling these “accesses,” the broker also appears to have logged into the software, appearing as a valid user to steal voluminous amounts of data.
Infostealers are malware designed to grab credentials from an endpoint, referred to by attackers as a log. Targeted data can include everything from SharePoint and corporate email login information to cryptocurrency wallet passwords and browser session cookies (see: Cybersecurity Trends: What’s in Store for Defenders in 2026?).
“Zestix is active on forums, particularly on forum.exploit.in, where the actor engages in discussions related to cybersecurity techniques and data leaks,” as well as “very active on Breach Forums,” said Check Point Software Technologies in a Dec. 29 report.
Hudson Rock said the Zestix persona appears to have emerged in late 2024 or early 2025 and “quickly established a reputation for reliability,” moving freely in Russian-speaking circles, including private cybercrime forums and regularly selling “accesses” in return for bitcoin. It said the same individual also appears to have used the handle “Sentap.”
Threat intelligence site DarkSignal on Monday reported that Sentap appears to be an Iranian national, and to have been active since 2021, if not earlier, primarily working “as an initial access broker and data extortion actor.”
Multiple threat researchers have tied Sentap to the ransomware group FunkSec, which launched in December 2024 and quickly gained notoriety – although potentially not success – for claiming to use artificial intelligence tools for one-fifth of its operations, reported researchers at Osint10x.
The compromise of widely used, cloud-based tools echoes the 2024 attack against about 165 customers of data warehousing platform Snowflake. Victims included Live Nation Entertainment’s Ticketmaster, Santander Bank, automotive parts supplier Advance Auto Parts and the Los Angeles Unified School District.
What all had in common: None were protecting their Snowflake accounts using MFA, meaning that after the attacker stole access credentials, they were able to use them to directly access the accounts and steal data, which they held to ransom, while simultaneously attempting to sell it on underground forums.
In the wake of the breach, Snowflake began offering more ways to implement MFA, making it active by default on new accounts.
Multiple tools exist to help administrators lock down the types of collaboration software targeted by Zestix, and potentially other initial access brokers. Some of these capabilities are built directly into the platforms, with Nextcloud noting that its platform monitors for suspicious logins, includes a free security scanner and alerts administrators if they aren’t using recommended security settings.
Even so, “this breach across various file sharing platforms shows that awareness around two-factor authentication is still not what it should be, and we will investigate what we can do to improve awareness among the hundreds of thousands of Nextcloud server administrators,” Nextcloud’s Poortvliet told ISMG.