Full Report
Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at least 100 million people. Moucka, 26, of Kitchener, Ontario, personally took at least $495,000 from
Analysis Summary
# Incident Report: 2024 Snowflake Customer Data Extortion Campaign
## Executive Summary
In 2024, a threat actor tracked as UNC5537 targeted over 165 organizations by leveraging stolen credentials to access their Snowflake cloud storage environments. The campaign resulted in the exposure of records for at least 100 million people, including sensitive call logs and PII, and led to the guilty plea of Canadian national Connor Riley Moucka. The primary catalyst was the lack of Multi-Factor Authentication (MFA) on customer accounts combined with long-lived, unrotated credentials harvested via infostealer malware.
## Incident Details
- **Discovery Date:** Early 2024 (Publicly disclosed/investigated by Mandiant/Snowflake in mid-2024)
- **Incident Date:** Campaign active through 2024; credentials harvested as early as Nov 2020
- **Affected Organization:** Snowflake (SaaS provider) customers (including AT&T)
- **Sector:** Technology, Telecommunications, Government, Finance
- **Geography:** Global (Primarily North America)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing since late 2020 (credential harvesting) through 2024 (active exploitation)
- **Vector:** Valid Credential Use
- **Details:** Attackers used credentials previously stolen by infostealer malware (e.g., Vidar, Redline) from customer employees. These credentials remained valid for years.
### Lateral Movement
- **Details:** The threat actor did not move laterally through Snowflake’s internal infrastructure; instead, they moved across different customer instances using stolen credentials that lacked MFA and network allow-lists.
### Data Exfiltration/Impact
- **Details:** Compromise of 165+ organizations. Stolen data included call/text history (AT&T), payroll records, DEA registration numbers, passport numbers, and Social Security numbers.
### Detection & Response
- **Discovery:** Identified by Snowflake and Mandiant following reports of customer data being offered for sale or held for ransom.
- **Response Actions:** Snowflake initiated a mass notification for at-risk customers and eventually moved to mandate MFA for all human users.
## Attack Methodology
- **Initial Access:** Use of valid credentials harvested via infostealer malware.
- **Persistence:** Access maintained via legitimate login sessions; no traditional backdoors were required.
- **Privilege Escalation:** Not applicable; attackers utilized existing administrative or high-level user permissions assigned to the stolen accounts.
- **Defense Evasion:** Use of legitimate credentials bypassed most security alerts; lack of network "allow lists" permitted logins from attacker-controlled IPs.
- **Credential Access:** Purchase or harvesting of credentials from infostealer logs (some up to 4 years old).
- **Discovery:** Reconnaissance of customer databases and cloud workspaces upon login.
- **Lateral Movement:** Credential stuffing/spraying across multiple distinct customer environments.
- **Collection:** Aggregation of sensitive tables including PII and communication logs.
- **Exfiltration:** Direct download of data from SaaS instances.
- **Impact:** Financial extortion through ransoms (Moucka took ~$495,000) and data sales.
## Impact Assessment
- **Financial:** Over $9.5 million in actual losses to victim companies; $495,000 in personal profit for Moucka.
- **Data Breach:** Sensitive records for 100+ million individuals (AT&T alone reported nearly all cellular customers affected).
- **Operational:** Massive resource drain for incident response and legal remediation across 165+ organizations.
- **Reputational:** Significant brand damage to Snowflake and high-profile clients like AT&T.
## Indicators of Compromise
- **Network indicators:** Logins from non-corporate IP ranges (Note: Specific IPs should be monitored via Mandiant UNC5537 intelligence feeds).
- **Behavioral indicators:**
- Logins using "old" credentials not rotated in 12+ months.
- Large-scale data exports from accounts without MFA.
- Logins from environments lacking Network Policy enforcement.
## Response Actions
- **Containment measures:** Disabling compromised accounts and enforcing MFA.
- **Eradication steps:** Identification and invalidation of all stolen credential sets identified in infostealer logs.
- **Recovery actions:** Snowflake began a phased rollout of mandatory MFA for all accounts, expected to conclude by October 2026.
## Lessons Learned
- **MFA is Non-Negotiable:** The absence of MFA on sensitive SaaS platforms is a critical failure point.
- **Credential Lifespan:** Credentials do not "expire" in the eyes of an attacker; infostealer logs from years ago remain viable if passwords aren't changed.
- **SaaS Responsibility Gap:** While the platform (Snowflake) was secure, the customer's configuration (no MFA, no IP filtering) led to the breach.
## Recommendations
- **Enforce MFA:** Implement phishing-resistant Multi-Factor Authentication for all users, especially service accounts and administrative roles.
- **Network Restrictions:** Implement "Network Allow Lists" (IP whitelisting) to ensure databases are only accessible from trusted corporate ranges or VPNs.
- **Credential Hygiene:** Implement automated password rotation policies and monitor for "leaked credential" databases.
- **EDR/Infostealer Monitoring:** Use Endpoint Detection and Response (EDR) tools on employee workstations to prevent infostealer malware from harvesting credentials in the first place.