Snowflake “breach” looks like 165 individual incidents

Cloud services provider Snowflake has posted information on its forums about “a targeted threat campaign against some Snowflake customer accounts,” in which the company maintains that this activity was not caused by a vulnerability, misconfiguration, or breach of its product.

For details, Snowflake points to research by Google’s Mandiant, which found that one cybercriminal obtained access to multiple organizations’ Snowflake customer instances using stolen customer credentials.

Mandiant identified that the threat actor used Snowflake customer credentials that were previously exposed via several infostealer malware variants, including VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER. These credentials were primarily obtained from infected non-Snowflake owned systems. It says it’s identified hundreds of customer Snowflake credentials that were obtained this way since 2020.

Another remarkable fact the analysis mentions is that in several cases, the initial compromise with the infostealer malware occurred on contractor systems that were also used for personal activities, including gaming and downloads of pirated software.

Mandiant attributes the attacks to a financially motivated group it calls UNC5537. We think it’s likely that this group is represented by the data seller posting under the handle Sp1d3r, which we have seen offering data sets for sale that are associated with the campaign targeting Snowflake customers.

The investigation’s preliminary findings are:

• Threat actors used credentials purchased or obtained through info-stealing malware.
• It appears to be a targeted campaign directed at users with single-factor authentication.
• It wasn’t a vulnerability, misconfiguration, or breach of Snowflake’s platform.
• It didn’t use credentials taken from current or former Snowflake personnel.
• A threat actor did use a former Snowflake employee’s personal credentials to access demo accounts. Snowflake says demo accounts are not connected to its production or corporate systems.

What baffles me is this advisory statement from Snowflake:

We are also developing a plan to require our customers to implement advanced security controls, like multi-factor authentication (MFA) or network policies, especially for privileged Snowflake customer accounts.

At this point, it’s time to say MFA should have been mandatory, not a customer choice. It is not just the first step to becoming NIS2 compliant. Given the sophistication of modern day cyberattacks and the cyber-arsenal available at an attacker’s fingertips, reliance on user-chosen passwords as a reliable form of defense must end.

It’s even debatable if every form of MFA is sufficient to protect important accounts like these. As we have seen, modern phishing kits are quite capable of intercepting and using some types of second factors, such as codes sent by SMS or generated by apps. Capturing a code entered by a user is just as easy as capturing a password entered by a user.

If your targets are important enough, cybercriminals can afford to invest in tools, methodology, and invested time. To date, Mandiant and Snowflake have notified approximately 165 potentially exposed organizations.