
Snowflake, the cloud computing and analytics giant, has raised an alarm about a credential theft campaign hitting a “limited number” of its customers.
In a joint statement with cybersecurity firms CrowdStrike and Google-owned Mandiant, Snowflake reassured users: “We have not found any evidence suggesting that this activity resulted from a vulnerability, misconfiguration, or breach of Snowflake’s platform.” They also confirmed that the activity wasn’t due to compromised credentials of their current or former employees.
The attackers seem to be focusing on users with single-factor authentication, using credentials stolen via information-stealing malware.
Mandiant CTO Charles Carmakal shared on LinkedIn, “Threat actors are actively compromising organizations’ Snowflake customer accounts by using stolen credentials from infostealing malware and logging into databases configured with single-factor authentication.”
To combat this, Snowflake is advising organizations to enable multi-factor authentication (MFA) and restrict network access to trusted locations only.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on Monday, urging organizations to follow Snowflake’s guidance to detect unusual activity and prevent unauthorized access. Similarly, the Australian Cyber Security Centre (ACSC) warned of successful breaches in companies using Snowflake environments.
Signs of the attacks include malicious connections from clients identifying themselves as “rapeflake” and “DBeaver_DBeaverUltimate.”
This warning follows Snowflake’s recent acknowledgment of increased malicious activity targeting customer accounts on its cloud platform.
See below for important updates from Snowflake regarding recent reports of unauthorized access of some customers’ data.
Crowdstrike and Mandiant have verified that Snowflake’s productions systems were NOT compromised.
Read more here: https://t.co/afElNSepFU pic.twitter.com/NzSX7rm9y1
— Bryan Beal 🎧 (@bryanrbeal) June 3, 2024
A report from cybersecurity firm Hudson Rock had earlier suggested that breaches at Ticketmaster and Santander Bank might have been caused by attackers using a Snowflake employee’s stolen credentials. However, this report has been retracted after Snowflake’s legal intervention. The exact cause of these breaches remains unclear, with the hacker persona ShinyHunters denying Hudson Rock’s claims, calling them “disinformation.”
Independent security researcher Kevin Beaumont emphasized the importance of robust multi-factor authentication, noting that infostealers have become a significant problem, outpacing botnets. It is believed that a teen crime group is behind these incidents.
Start Growing with Cloudways Today.
Our Clients Love us because we never compromise on these
Abdul Rehman
Abdul is a tech-savvy, coffee-fueled, and creatively driven marketer who loves keeping up with the latest software updates and tech gadgets. He's also a skilled technical writer who can explain complex concepts simply for a broad audience. Abdul enjoys sharing his knowledge of the Cloud industry through user manuals, documentation, and blog posts.