Full Report
A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims. [...]
Analysis Summary
# Incident Report: Extortion Campaign Exploiting Snowflake Cloud Accounts
## Executive Summary
A collaborative threat actor group (Connor Moucka and John Binns) targeted at least 165 organizations using Snowflake cloud storage by exploiting accounts lacking Multi-Factor Authentication (MFA). The attackers exfiltrated terabytes of sensitive data and extorted victims for millions of dollars, impacting over 100 million individuals. The incident concluded with the arrest and guilty plea of the primary perpetrator, resulting in significant industry-wide shifts in cloud security defaults.
## Incident Details
- **Discovery Date:** Approximately May 2024 (public disclosure began)
- **Incident Date:** February 2024 – October 2024
- **Affected Organization:** 165+ Snowflake customers (including AT&T, Ticketmaster, Santander)
- **Sector:** Diversified (Telecom, Finance, Retail, Entertainment, Government)
- **Geography:** Global (Attackers based in Canada and Turkey)
## Timeline of Events
### Initial Access
- **Date/Time:** Beginning February 2024
- **Vector:** Credential Stuffing / Valid Accounts
- **Details:** Attackers used login credentials previously stolen via infostealer malware from non-Snowflake systems.
### Lateral Movement
- **Details:** Access was limited to the cloud tenant level; however, attackers moved between different customer accounts (tenants) using distinct stolen credentials. They used custom software to scan for valuable data, including organization names, user roles, and IP addresses.
### Data Exfiltration/Impact
- **Details:** Terabytes of data stolen across 165 organizations. Stolen data included call/text logs (AT&T), SSNs, financial records, DEA registration numbers, and PII.
### Detection & Response
- **Detection:** Identified following a wave of extortion attempts and public data sales on hacker forums.
- **Response:** Law enforcement investigation (FBI/RCMP) led to the arrest of Connor Moucka in Canada (Oct 2024) and John Binns in Turkey.
## Attack Methodology
- **Initial Access:** Use of "Valid Accounts" (Username/Password) obtained via infostealer logs.
- **Persistence:** Not explicitly mentioned, but likely through the continued use of compromised credentials.
- **Privilege Escalation:** Exploited broad permissions assigned to compromised user roles within the Snowflake environment.
- **Defense Evasion:** Targeted accounts specifically lacking MFA, as these accounts provided the path of least resistance.
- **Credential Access:** Credential harvesting via third-party infostealer malware (pre-incident).
- **Discovery:** Custom scripts used to automate the identification of sensitive databases and user roles within the cloud environment.
- **Lateral Movement:** Cloud-to-cloud movement between customer tenants.
- **Collection:** Aggregation of terabytes of PII and corporate records.
- **Exfiltration:** Transfer of data from Snowflake environments to attacker-controlled infrastructure.
- **Impact:** Financial extortion (demanding Bitcoin), re-extortion of victims, and public sale of data on forums.
## Impact Assessment
- **Financial:** At least $2.5 million paid by three victims; total losses to companies exceed $9.5 million.
- **Data Breach:** Over 100 million individuals’ PII exposed, including 109 million AT&T customer records.
- **Operational:** Disruption to 165+ organizations and significant incident response overhead.
- **Reputational:** Massive public fallout for major brands and Snowflake regarding security defaults.
## Indicators of Compromise
- **Network indicators:** Connections from unusual geolocations or known VPNs/Tor exit nodes to Snowflake instances (Defanged: hxxp[://]snowflake[.]com).
- **Behavioral indicators:** Rapid automated enumeration of tables and schemas; large-scale data egress from cloud tenants by a single user account.
## Response Actions
- **Containment:** Suspension of compromised accounts and revocation of leaked credentials.
- **Eradication:** Law enforcement seizure of attacker infrastructure and arrest of suspects.
- **Recovery:** Mandatory password resets and enforcement of new security policies.
## Lessons Learned
- **MFA is Non-Negotiable:** The absence of MFA on administrative or data-heavy accounts is a critical failure point.
- **Infostealer Ecosystem:** Organizations are vulnerable to credentials stolen from employees' personal devices or non-work accounts if those credentials are reused.
- **Default Security Settings:** Cloud providers should enforce "Secure by Default" settings rather than leaving them as optional configurations.
## Recommendations
- **Enforce MFA:** Mandatory Multi-Factor Authentication for all users, especially those with access to data warehouses.
- **Password Complexity:** Implement a minimum 14-character password policy.
- **Network Restriction:** Use Network Policies to restrict Snowflake access to known corporate IP ranges or VPN gateways.
- **Continuous Monitoring:** Implement alerts for large data transfers (egress monitoring) and logins from unrecognized locations/devices.