Snowflake Warns: Targeted Credential Theft Campaign Hits Cloud Customers

Cloud computing and analytics organization Snowflake claimed a “constrained number” of its buyers have been singled out as portion of a targeted marketing campaign.

“We have not discovered proof suggesting this exercise was triggered by a vulnerability, misconfiguration, or breach of Snowflake’s platform,” the firm claimed in a joint assertion along with CrowdStrike and Google-owned Mandiant.

“We have not discovered proof suggesting this action was brought about by compromised credentials of existing or former Snowflake staff.”

It additional explained the action is directed towards customers with solitary-component authentication, with the unknown risk actors leveraging credentials beforehand obtained or received by information and facts-thieving malware.

“Menace actors are actively compromising organizations’ Snowflake purchaser tenants by making use of stolen qualifications received by infostealing malware and logging into databases that are configured with single issue authentication,” Mandiant CTO Charles Carmakal claimed in a publish on LinkedIn.

Snowflake is also urging businesses to permit multi-issue authentication (MFA) and limit network targeted visitors only from trustworthy locations.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in an alert issued on Monday, proposed corporations abide by the advice outlined by Snowflake to hunt for signals of unconventional action and choose actions to avoid unauthorized user accessibility.

A very similar advisory from the Australian Alerts Directorate’s Australian Cyber Security Centre (ACSC) warned of “profitable compromises of a number of providers using Snowflake environments.”

Some of the indicators incorporate malicious connections originating from customers figuring out them selves as “rapeflake” and “DBeaver_DBeaverUltimate.”

The development arrives times right after the firm acknowledged that it has noticed a spike in destructive activity targeting buyer accounts on its cloud details platform.

Whilst a report from cybersecurity organization Hudson Rock earlier implied that the breach of Ticketmaster and Santander Lender might have stemmed from risk actors working with a Snowflake employee’s stolen qualifications, it has given that been taken down, citing a letter it acquired from Snowflake’s lawful counsel.

It is really at present not acknowledged how the two firms – which are both Snowflake clients – had their info stolen. ShinyHunters, the persona who claimed accountability for the twin breaches on the now-resurrected BreachForums, explained to DataBreaches.net that Hudson Rock’s clarification was incorrect and that it is really “disinformation.”

“Infostealers are a sizeable dilemma — it has prolonged given that outpaced botnets and so forth. in the genuine earth — and the only authentic option is strong multi-component authentication,” impartial security researcher Kevin Beaumont explained. It’s thought that a teenager crime team is behind the incident.

Found this write-up fascinating? Comply with us on Twitter  and LinkedIn to examine far more distinctive articles we put up.

Some parts of this article are sourced from:
thehackernews.com