Full Report
Snowflake hacker's guilty plea covers a 100M-record breach, Mythos 5 spends 34 hours trying to backdoor real code, and ChainDrop's worm spreads via npm.
Analysis Summary
# Incident Report: Snowflake Customer Account Data Theft & Extortion
## Executive Summary
A cybercriminal group, led by Connor Riley Moucka, targeted 165 organizations by exploiting Snowflake customer accounts that lacked multi-factor authentication (MFA). The campaign resulted in the exposure of records belonging to at least 100 million individuals and successful extortion attempts totaling nearly $500,000. The incident highlights the critical risk of credential stuffing and the dangers of failing to implement basic identity security controls like MFA and network allow-lists.
## Incident Details
- **Discovery Date:** 2024 (Widely reported/investigated by Mandiant as UNC5537)
- **Incident Date:** Ongoing through 2024 (Credentials harvested as early as Nov 2020)
- **Affected Organization:** 165 Snowflake customers (including major enterprises)
- **Sector:** Diversified (Cloud Storage Customers)
- **Geography:** Global / United States
## Timeline of Events
### Initial Access
- **Date/Time:** Credentials harvested starting November 2020; primary breach activity peaked in 2024.
- **Vector:** Credential Stuffing / Infostealer Malware.
- **Details:** Threat actors utilized valid credentials stolen via infostealer malware from non-Snowflake systems.
### Lateral Movement
- Not applicable in the traditional sense; attackers used stolen credentials to log directly into victim Snowflake instances.
### Data Exfiltration/Impact
- Mass-download of databases containing sensitive records for approximately 100 million people across 165 different organizations.
### Detection & Response
- **How it was discovered:** Internal investigations by Snowflake and Mandiant (Google Cloud) following reports of customer data appearing on extortion sites.
- **Response actions taken:** US federal prosecution of Connor Riley Moucka; Moucka pleaded guilty in Seattle federal court in August 2026.
## Attack Methodology
- **Initial Access:** Valid Accounts (Cloud Accounts).
- **Persistence:** Not required; repeated use of valid credentials.
- **Privilege Escalation:** Not specified; access was inherently sufficient for data theft.
- **Defense Evasion:** Targeted accounts specifically lacking Multi-Factor Authentication (MFA) and Network Allow-lists.
- **Credential Access:** Infostealer malware (logs purchased or harvested from previous infections).
- **Discovery:** Identification of Snowflake instances associated with stolen credentials.
- **Lateral Movement:** Not applicable.
- **Collection:** Bulk data export from cloud storage.
- **Exfiltration:** Transfer of data to attacker-controlled infrastructure for extortion purposes.
- **Impact:** Data Theft and Financial Extortion.
## Impact Assessment
- **Financial:** Moucka collected at least $495,000 via ransoms and data sales.
- **Data Breach:** Over 100 million individual records exposed.
- **Operational:** Significant investigation and remediation costs for 165 organizations.
- **Reputational:** High-profile impact on Snowflake's brand perception and the security posture of its customers.
## Indicators of Compromise
- **Network indicators:** Access from non-corporate IP ranges (Use of VPNs/VPS).
- **Behavioral indicators:** Unusual volume of data egress; logins from IPs with no prior history; lack of MFA prompts for high-privilege service accounts.
## Response Actions
- **Containment:** Snowflake and Mandiant notified affected customers to rotate credentials and enable MFA.
- **Eradication:** Law enforcement intervention resulting in the arrest and guilty plea of the primary perpetrator.
- **Recovery:** Customers forced to rebuild data security configurations and notify affected individuals.
## Lessons Learned
- **MFA is Non-Negotiable:** 100% of the compromised accounts lacked MFA.
- **Credential Hygiene:** Over 75% of the accounts used credentials that had been previously exposed in unrelated breaches.
- **Shared Responsibility:** Cloud providers provide the tools (MFA, Allow-lists), but customers must implement them to be secure.
## Recommendations
- **Enforce MFA:** Mandatory Multi-Factor Authentication for all administrative and data-access accounts.
- **Network Security:** Implement Network Allow-lists (IP whitelisting) to restrict access to known corporate environments.
- **Credential Rotation:** Regularly rotate service account credentials and passwords, especially after any suspected malware infection on employee devices.
- **Monitoring:** Set up automated alerts for large-scale data transfers or unusual egress patterns from cloud warehouses.