Active Snowflake data theft persists as Wednesday disclosures tie breaches to stolen credentials
Marcus Webb ·
Enterprises using Snowflake disclosed new data exposures on Wednesday, linking incidents to a still active campaign that logs in with credentials stolen by commodity infostealers from employee endpoints. Investigators say activity continues across North America and Europe because many tenants lack multifactor authentication on database users and rely on long lived API tokens and broad IP allowlists.
The campaign aligns with activity Mandiant tracked in 2024 as UNC5537, which automated exfiltration via SnowSQL and JDBC or ODBC clients, and through OAuth based integrations. Analysts stress this is not a Snowflake vulnerability, it is adversaries reusing valid passwords, session tokens, and refresh tokens at scale.
Tactics and indicators
Incident responders report attackers staging from cloud virtual machines that rotate IP space to match expected geographies, then issuing bulk SELECT and UNLOAD or COPY INTO queries against high value schemas. Data is moved to attacker controlled cloud storage using Rclone or to external stages bound to attacker owned storage via storage integrations.
Post access actions include creating secondary database users, registering new OAuth or security integrations, and relaxing or removing network policies. Query history shows concentrated reads of customer, payment, and telemetry tables, followed by sustained egress measured in hundreds of gigabytes.
Effective credentials often originate from infostealer logs such as RedLine, Raccoon, or Lumma, harvested from unmanaged or poorly monitored endpoints. Several 2024 breaches at Ticketmaster and Santander were tied publicly to Snowflake tenant access with stolen credentials, and responders say similar tradecraft is present in current cases.
Mitigation path
Security teams should enforce multifactor authentication for all interactive Snowflake users and service operators, rotate all secrets and OAuth refresh tokens, and invalidate persistent sessions. Audit ACCOUNT_USAGE views such as LOGIN_HISTORY, QUERY_HISTORY, and ACCESS_HISTORY for unfamiliar clients, new IP ranges, unusual UNLOAD or COPY INTO patterns, and elevated volumes to external stages.
Review and lock down network policies to restrict source IPs, and require private connectivity where possible. Enumerate and validate all SECURITY INTEGRATION and STORAGE INTEGRATION objects, disable any unknown integrations, and rotate associated cloud roles and keys. Disable unused legacy clients, implement conditional access on identity providers, and continuously ingest Snowflake audit logs into a SIEM with detections for non MFA logins and privilege changes.
For technology leaders, the sustained campaign underscores that cloud data platforms are only as strong as identity, token hygiene, and SaaS configuration. Controls that were optional in 2024, including MFA on all database users and tight network policies, now function as baseline requirements as regulators scrutinize what constitutes reasonable authentication for high value data.