Cloud storage platform hit by cyberattack

The revelations were made public earlier this week by security company, Mandiant, when it was announced that hackers are focusing on customer instances on Snowflake, exploiting leaked login information to breached accounts. 

Mandiant, which is owned by Google, clarified that these strikes are limited to customer accounts and do not compromise the Snowflake service infrastructure itself. Snowflake, known for its cloud and data management services, now sees its customers in the crosshairs of cybercriminals.

While Mandiant did not identify a group behind these incidents, it classified the malicious events under the code UNC5537, stating:

“Mandiant tracks this cluster of activity as UNC5537, a financially motivated threat actor suspected to have stolen a significant volume of records from Snowflake customer environments.”

“UNC5537 is systematically compromising Snowflake customer instances using stolen customer credentials, advertising victim data for sale on cybercrime forums, and attempting to extort many of the victims,” Mandiant continued.

These attacks appear unrelated to the recent Snowflake breach by the notorious ShinyHunters group, who claim to have obtained hundreds of millions of credentials. Snowflake has downplayed this breach, attributing it to a test environment managed by a former employee. However, this incident did result in data breaches for companies such as Ticketmaster and Santander Bank. 

UNC5537 has been active since at least 2020, with Mandiant saying that around 165 organisations are at risk. Experts say the attackers are using data theft malware to harvest user login credentials, which are then employed to access and further exploit Snowflake instances. The stolen data is typically sold on the dark web or used for ransomware schemes.

Mandiant has advised Snowflake customers to adopt two-factor authentication (2FA) to safeguard their accounts. The firm noted that all the breaches they observed involved users who had not enabled 2FA, underscoring the critical need for this security measure.

Know the risks

In an era characterised by increasingly sophisticated cyberattacks, the Snowflake data breach serves as a reminder of the critical need for continually optimised cybersecurity in cloud infrastructures.

Business leaders can get to the edge of the conversation this October at #RISK London, where experts will debate the new wave of cyber-threats that organisations face in our digitising world.