Snowflake Customer Instance Extortion Campaign (UNC5537 / Connor Riley Moucka)

Technical Analysis

The threat actor leveraged credentials harvested from prior infostealer malware infections (e.g., Lumma, Vidar-family logs sold on criminal markets) to access customer Snowflake cloud data warehouse instances that lacked multi-factor authentication and had long-lived, non-rotated credentials. Attackers used automated tooling to enumerate and exfiltrate large datasets, then issued extortion demands, threatening public release or sale of stolen data. No direct exploitation of a Snowflake platform vulnerability was involved; the root cause was systemic identity and access management failure at the customer level. Organizations running AI agents or RAG pipelines that connect to Snowflake as a backend data source are at risk if the same credential hygiene gaps exist, since compromised API keys or service account tokens used by agentic data-retrieval workflows could grant equivalent unauthorized access to sensitive warehoused data. This case underscores that agent-integrated cloud data platforms are attractive high-value targets when authentication controls are weak.

Affected Systems

Snowflake cloud data warehouse customer tenants lacking MFA; customer-managed service accounts and API/OAuth tokens with excessive privileges or no expiration; specifically confirmed impacted: AT&T customer records, plus 165+ organizations using Snowflake for data storage/analytics.

Indicators of Compromise

• N/A - primarily credential-based access; no consistent malware hashes or C2 domains publicly attributed to this specific actor's Snowflake activity at time of reporting

Remediation Steps

1. 1

   Enforce MFA on all cloud data platform accounts

   Require multi-factor authentication for all Snowflake and similar cloud data warehouse accounts, including service and API accounts where feasible.

2. 2

   Rotate and scope credentials/API keys

   Rotate all long-lived credentials and API keys, especially those used by automation, agent pipelines, or RAG systems connecting to Snowflake; apply least-privilege scoping.

3. 3

   Monitor for infostealer-sourced credential exposure

   Subscribe to credential leak monitoring services to detect employee or service account credentials appearing in infostealer logs sold on criminal markets.

4. 4

   Audit agent and automation access to data warehouses

   Review which AI agents, LLM tools, or automated pipelines hold Snowflake credentials or tokens and ensure those secrets are stored in secrets managers, not plaintext config.

5. 5

   Implement anomaly detection on data egress

   Deploy monitoring for unusual bulk data export or query volume from cloud data warehouse accounts to detect exfiltration attempts early.