Full Report
Connor Moucka obtained almost $500,000 for playing a key role in one of the most widespread and damaging cyberattack sprees on record. The post Snowflake hacker pleads guilty, faces up to 32 years in prison appeared first on CyberScoop.
Analysis Summary
# Incident Report: Widespread Compromise of Snowflake Customer Environments
## Executive Summary
In mid-2024, a cybercriminal group exploited stolen credentials to breach over 165 Snowflake customer environments, resulting in the theft of billions of sensitive records. The attack targeted high-profile corporations for extortion, leading to over $9.5 million in combined corporate losses and the theft of data belonging to hundreds of millions of individuals. The primary suspect, Connor Moucka (aka "Waifu"), was arrested in October 2024 and has since pleaded guilty to federal charges.
## Incident Details
- **Discovery Date:** Approximately May/June 2024 (Campaign identified by Mandiant/Snowflake)
- **Incident Date:** April 2024 – October 2024
- **Affected Organization:** Snowflake (Platform), with 165+ downstream customers (e.g., AT&T, Ticketmaster, Santander, Advance Auto Parts)
- **Sector:** Technology, Telecommunications, Finance, Retail, Entertainment
- **Geography:** Global; Suspect based in Ontario, Canada
## Timeline of Events
### Initial Access
- **Date/Time:** Starting April 2024
- **Vector:** Credential Stuffing / Stolen Credentials
- **Details:** Attackers used valid login credentials previously harvested from infostealer malware infections on non-Snowflake systems.
### Lateral Movement
- **Details:** Because the attackers possessed valid credentials for administrative or high-privilege accounts that lacked Multi-Factor Authentication (MFA), they moved directly into the cloud data warehouses without needing traditional lateral movement techniques.
### Data Exfiltration/Impact
- **Details:** Stole billions of records including call/text histories (AT&T), banking info (Santander), and 560 million customer records (Ticketmaster). Moucka personally extorted victims for nearly $500,000, while the wider conspiracy netted $2.5 million.
### Detection & Response
- **How it was discovered:** Security researchers (Mandiant) and Snowflake observed a spike in unauthorized access targeting accounts without MFA.
- **Response actions taken:** Law enforcement investigation (FBI/RCMP); Arrest of Connor Moucka on Oct 30, 2024; Extradition to the U.S. in March 2025; Guilty plea entered in 2026.
## Attack Methodology
- **Initial Access:** Valid accounts using stolen credentials from previous malware infections.
- **Persistence:** Utilization of legitimate cloud storage access tools.
- **Privilege Escalation:** Exploitation of single-factor (password-only) administrative accounts.
- **Defense Evasion:** Use of legitimate credentials to blend in with authorized traffic; operating via "The Com" cybercriminal network infrastructure.
- **Credential Access:** Infostealer logs purchased or obtained from underground markets.
- **Discovery:** Identifying Snowflake instances via public-facing internet scanning.
- **Lateral Movement:** Direct access to target databases using stolen cloud credentials.
- **Collection:** Bulk querying of sensitive tables and databases.
- **Exfiltration:** Transfer of data to attacker-controlled infrastructure for extortion purposes.
- **Impact:** Financial extortion, massive data breaches, and re-extortion of sensitive government-related data.
## Impact Assessment
- **Financial:** Over $9.5 million in direct victim company losses; $2.5 million in paid ransoms.
- **Data Breach:** Billions of sensitive records; call/text logs, payroll, banking info, and government IDs for 100M+ people.
- **Operational:** Significant resource diversion for forensic investigation and remediation.
- **Reputational:** Massive public scrutiny for both Snowflake (for security defaults) and the affected clients.
## Indicators of Compromise
- **Network indicators:** Traffic originating from commercial VPNs and specific hosting providers used by "The Com."
- **Behavioral indicators:** Unusual bulk data export (SELECT *) commands from IP addresses not previously associated with the user account; logins to administrative accounts from new geographic locations without MFA prompts.
## Response Actions
- **Containment measures:** Snowflake issued mandatory MFA requirements for certain users and alerted affected customers.
- **Eradication steps:** Disabling compromised credentials and rotating all secrets.
- **Recovery actions:** Data restoration and implementation of enhanced monitoring for cloud storage environments.
## Lessons Learned
- **MFA is Mandatory:** The lack of Multi-Factor Authentication on a single service can lead to a catastrophic supply-chain-style breach.
- **Shared Responsibility:** Organizations must realize that while a provider (Snowflake) secures the infrastructure, the customer is responsible for securing their own credentials and access policies.
- **Credential Hygiene:** Stolen credentials from a home or unrelated computer can be used to breach enterprise cloud environments.
## Recommendations
- **Enforce MFA:** Mandate phishing-resistant Multi-Factor Authentication (FIDO2) for all cloud environment access.
- **Network Whitelisting:** Implement IP address allow-listing to ensure cloud databases are only accessible from known corporate ranges or secure gateways.
- **Monitoring:** Implement alerting for "impossible travel" and large-scale data egress patterns.
- **Credential Monitoring:** Use services to monitor for leaked corporate credentials on the dark web.