Snowflake attack research - data breaches are related to infostealer attacks and no MFA
Take action: Another lesson about the value of enforcing MFA and SSO with MFA. Everyone is too comfortable with passwords, and now passwords are even more dangerous with Infostealer malware being a very popular tool. Do not install programs from unknown sources or from emails. Don't trust even your own old USBs and CDs.
Learn More
Security researchers from Mandiant are reporting that approximately 165 organizations have been impacted by a large-scale cyber campaign targeting Snowflake cloud storage systems using stolen customer credentials.
The campaign, attributed to the financially motivated threat actor UNC5537, involves exploiting credentials obtained through infostealer malware. Per the report from Mandiant the malware infections apparently did not occur on Snowflake's systems and there is no evidence to suggest that the unauthorized access stemmed from a breach within Snowflake’s enterprise environment.
Cloud data analytics platform Snowflake announced that it will enforce multi-factor authentication following what might be one of the largest data breaches on record.
Mandiant's investigation reveals that the campaign leveraged historical infostealer infections, some dating as far back as 2020, to acquire the credentials. These credentials were then used to access Snowflake instances and exfiltrate data. The absence of multi-factor authentication (MFA) and network allow lists exacerbated the vulnerability of the targeted accounts. The campaign began on April 14, 2024.
The threat actor, UNC5537, executed SQL commands for reconnaissance and data staging and exfiltration.
UNC5537 has been observed selling the stolen data on cybercriminal forums and attempting to extort victim organizations. The group comprises individuals primarily based in North America, with at least one member in Turkey, and has ties to other known threat groups. Despite the significant impact, Mandiant notes that UNC5537's campaign did not employ particularly novel or sophisticated tools or techniques but capitalized on the infostealer marketplace and security oversights.
Snowflake has stated that there is no evidence of a direct breach of its platform and that the unauthorized access was due to compromised customer credentials.
Update - As of 16th of June 2024, hacker operation UNC5537 is starting data extortion against organizations impacted by the Snowflake breach, with up to 10 affected entities pressured to pay ransoms ranging from $300,000 to $5 million.
