What investigators reported
Mandiant published its UNC5537 investigation on 10 June 2024. It described attackers using stolen customer credentials to access Snowflake instances and steal data for extortion. In the incidents it investigated, it did not find evidence that access originated from a breach of Snowflake’s enterprise environment.
The report identified compromised credentials, absent multifactor authentication and insufficient network restrictions as recurring conditions. The date above is the public report date for a campaign, rather than a claim that all affected organizations were compromised on one day.
Inventory identities as carefully as databases
Our analysis: cloud security review should follow the credential from the employee device to the dataset it can export. An account with broad read access can create a serious confidentiality incident without administrative privileges or a software exploit.
Separate interactive users from service identities. Enforce appropriate strong authentication for human access, scope workload credentials to a specific job and remove unused identities. Review network policies with operational owners so emergency access does not become a permanent unrestricted path.
Make collection detectable
Establish baselines for authentication source, client, query volume and export patterns. Alert on unusual combinations, such as a new client followed by enumeration and a large export. Retain the relevant query and access history long enough to investigate delayed reports.
If credential theft is suspected, revoke sessions and replace credentials from a trusted environment. Identify copies of the secret in local tooling, notebooks and automation. Recovery should include the source of the theft and the data accessed, rather than stopping at a password reset.
Controls to take away
- Require strong authentication and scope data access.
- Investigate unusual exports alongside unusual logins.
- Revoke sessions and address the original credential theft.
Sources & further reading
Incident facts are attributed to the reports below. Controls and recommendations are our interpretation; this is not an independent forensic investigation.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.