Removed: nothing. The impacted accounts had no multi-factor authentication, the credentials had “not been rotated for as long as four years”, and the instances “did not have network allow lists in place to only allow access from trusted locations”.
Outcome: Mandiant tracked the campaign as UNC5537 and found it “systematically compromising Snowflake customer instances using stolen customer credentials, advertising victim data for sale on cybercrime forums, and attempting to extort many of the victims”. Mandiant and Snowflake notified approximately 165 potentially exposed organisations. Per their joint analysis, “at least 79.7% of the accounts leveraged by the threat actor in this campaign had prior credential exposure”, some of it dating back to infostealer infections in November 2020.
Three conditions made the campaign work, in Mandiant’s own list: no MFA, credentials still valid years after they were stolen, and no allow lists. Every one of them is a standing-access decision — an identity that keeps working indefinitely for whoever holds the password. Mandiant “has not found any evidence to suggest that unauthorized access to Snowflake customer accounts stemmed from a breach of Snowflake’s enterprise environment”; the way in was the customers’ identity hygiene, and the payoff was the volume of customer data held in the warehouses.
Source: Mandiant (Google Cloud), UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (10 June 2024)