Large-Scale Credential Theft Campaign Targets Snowflake Cloud Storage

A new report from Mandiant has revealed that approximately 165 organizations have been affected by a large-scale campaign exploiting stolen customer credentials to target Snowflake cloud storage systems. The campaign is attributed to a financially motivated threat actor identified as UNC5537.

How the Attack Unfolded

UNC5537 has compromised hundreds of Snowflake instances by using customer credentials that were stolen via infostealer malware. This malware infected systems that are not owned by Snowflake, resulting in unauthorized access to customer accounts.

Mandiant's investigation found no evidence of a breach in Snowflake's enterprise environment. Instead, each incident traced back to compromised customer credentials. The attacks began on April 14, targeting accounts without proper multi-factor authentication (MFA) protections. Some of these credentials were stolen years ago.

Source of the Compromised Credentials

According to Mandiant, most of the credentials used by UNC5537 came from historical infostealer infections dating back as far as 2020. The malware used to steal these credentials included Lumma, Meta, Racoon Stealer, Redline, Risepro, and Vidar. Some contractor systems, used for both professional and personal activities, were also infected.

Vulnerabilities Exploited

The compromised Snowflake instances lacked MFA, used long-exposed credentials that had not been rotated, and did not have network allow lists. Approximately 80% of the accounts had prior credential exposure.

UNC5537 accessed the compromised customer accounts through various tools including the native web-based UI, the command-line tool SnowSQL, a custom utility named ‘rapeflake’ (also known as FrostBite), and the database management tool DBeaver Ultimate. The threat actor executed SQL commands for reconnaissance and data exfiltration.

Impact and Consequences

UNC5537 has targeted hundreds of organizations worldwide, exfiltrating significant amounts of data which they have used to extort victim organizations. The group is actively attempting to sell stolen data on cybercriminal forums. Members of UNC5537 operate mainly in North America, with one member in Turkey, and some are linked to other known threat groups.

Broader Implications

Mandiant emphasized that the widespread impact of this campaign is not due to any particularly novel or sophisticated tools but is rather a consequence of the expanding infostealer marketplace and missed opportunities to secure credentials better. High-profile victims named in the campaign include Ticketmaster, Santander Bank, Anheuser-Busch, Allstate, Advance Auto Parts, Mitsubishi, Neiman Marcus, Progressive, and State Farm.