Snowflake Breach Exposes 165 Clients’ Information in Ongoing Extortion Plot
Approximately 165 clientele of Snowflake may have had their details potentially uncovered as part of an ongoing scheme designed to enable data theft and extortion, indicating the operation has broader consequences than previously anticipated.
Mandiant, owned by Google, which is aiding the cloud data warehousing platform in its incident response endeavors, is monitoring the ongoing activity cluster under the name UNC5537, characterizing it as a financially driven threat actor.
“UNC5537 is methodically compromising Snowflake client instances using purloined client credentials, promoting victim data for sale on cybercrime forums, and trying to coerce many of the victims,” the threat intelligence firm stated on Monday.
“UNC5537 has aimed at hundreds of institutions worldwide, and often blackmails victims for financial gain. UNC5537 functions under various pseudonyms on Telegram channels and cybercrime forums.”
There is proof to suggest that the hacking syndicate consists of members based in North America. It is also suspected to collaborate with at least one additional group based in Turkey.
This marks the first instance where the number of impacted clients has been officially revealed. Snowflake had previously mentioned that a “restricted number” of its clientele were affected by the incident. The corporation has over 9,820 global clients.
The operation, as previously delineated by Snowflake, originates from compromised client credentials bought from cybercrime forums or acquired through information-stealing malware such as Lumma, MetaStealer, Raccoon, RedLine, RisePro, and Vidar. It is assumed to have commenced on April 14, 2024.
In several cases, the stealer malware infections have been observed on contractor systems that were also used for recreational activities, such as gaming and downloading pirated software, the latter of which has been a tried-and-tested channel for disseminating stealers.
The unauthorized entry to client instances has led to the development of a reconnaissance tool named FROSTBITE (often known as “rapeflake”) that is utilized to execute SQL queries and gather details about the users, current roles, present IPs, session IDs, and organization names.
Mandiant mentioned it has not obtained a full sample of FROSTBITE, with the company also highlighting the threat actor’s use of a legitimate tool called DBeaver Ultimate to link and execute SQL queries across Snowflake instances. The ultimate phase of the attack comprises the antagonist executing commands to prepare and extract data.
Snowflake, in an updated notice, mentioned that it is collaborating closely with its users to strengthen their security measures. It also said that it is devising a strategy to necessitate them to implement advanced security controls, such as multi-factor authentication (MFA) or network policies.
The assaults, Mandiant remarked, have achieved significant success due to three primary reasons: the absence of multi-factor authentication (MFA), infrequent rotation of credentials, and the lack of checks to guarantee access solely from trusted locations.
“The earliest infostealer infection date observed associated withAccording to Mandiant, a credential utilized by the malicious actor traces back to November 2020,” as Mandiant stated, additionally revealing that “it pinpointed hundreds of customer Snowflake credentials exposed through infostealers since 2020.”
“This operation underlines the repercussions of an extensive volume of credentials circulating within the infostealer market and could potentially mirror a specific interest from threat actors towards comparable SaaS platforms.”
The discoveries serve to emphasize the growing market demand for data thieves and the widespread danger they present to entities, leading to the continual emergence of fresh stealer variations like AsukaStealer, Cuckoo, Iluria, k1w1, SamsStealer, and Seidr that are made available for acquisition by other illegal players.
“During February, Sultan, the persona linked to Vidar malware, posted an image showcasing the Lumma and Raccoon stealers standing united against antivirus solutions,” as outlined in a recent analysis by Cyfirma. “This points towards collaboration among malicious actors, as they unite and exchange resources to attain their objectives.”
About Author
