In spring 2024, a threat actor conducted a large-scale credential theft campaign targeting customers of Snowflake, the cloud data warehousing platform. The attacker used infostealer malware logs - harvested credentials from previous malware infections - to authenticate to Snowflake tenant accounts that had not enabled multi-factor authentication. Because the credentials were valid and MFA was absent, there was no malware, no vulnerability, no exploit. The attackers simply logged in.

The downstream consequences were severe. Among the compromised Snowflake tenants were major corporations including Ticketmaster (confirmed by Mandiant, affecting 560 million records), Santander Bank (Spanish and South American customer data), Advance Auto Parts (380 million customer records), and AT&T (records of call and text message metadata for virtually all AT&T customers). The ShinyHunters threat group claimed responsibility for the Ticketmaster breach and was believed responsible for multiple others in the campaign. The total number of affected customers across all breached tenants numbered in the hundreds of millions.

How Infostealer Logs Enable Credential Attacks

The Snowflake campaign illustrated the downstream damage from the infostealer ecosystem. Infostealers are malware programs (Redline, Raccoon, Vidar, LummaC2, and many others) designed to harvest credentials, cookies, and browser-stored passwords from infected machines. Infostealers typically target consumer systems, gaming computers, and devices of employees who mix personal and work usage. Once a device is infected, the malware exfiltrates credentials for every site the user has authenticated to, along with session cookies, autofill data, and cryptocurrency wallet files.

The harvested data is sold on underground markets as "logs" - bundles of credentials and cookies from infected machines, sold per-device or in bulk. Threat actors buy these logs and search them for high-value credentials: corporate SSO logins, cloud platform access, SaaS application credentials. In the case of the Snowflake campaign, attackers searched infostealer logs for Snowflake.com credentials and found valid logins for corporate Snowflake tenants held by employees who had used their work credentials on infected machines.

The critical enabling condition was the absence of MFA. Snowflake did not require MFA for customer tenants by default - it was an optional configuration. Many enterprises had not enabled it. Stolen username/password pairs were sufficient for full access. Snowflake's architecture gave each tenant isolated cloud-hosted storage for their data; an authenticated attacker had immediate access to all data stored in that tenant, which in the case of analytics platforms like Snowflake often included years of transactional data, customer records, and internal analytics.

[TECHNICAL NOTE]
The Snowflake credential attack chain: (1) Infostealer malware infects an employee's device (typically through a phishing email, malicious game mod, cracked software, or similar consumer vector). (2) The malware harvests all stored browser credentials and cookies from the device, including Snowflake.com login credentials if the employee has authenticated to their corporate Snowflake account in the browser. (3) Logs are uploaded to underground markets (2easy, RussianMarket, Genesis Market successor platforms). (4) The attacker purchases or obtains logs and queries them for Snowflake.com credentials. (5) Using automation (the attacker's own tooling or commercial tools), the attacker tests the credentials against Snowflake's API. Valid credentials with no MFA requirement grant immediate authenticated access. (6) Once inside the tenant, the attacker runs SQL queries to identify and export sensitive data, then uses Snowflake's bulk data transfer features (or simply stages data for extraction). The attack required no Snowflake vulnerabilities. The technical entry was entirely through valid credentials. Snowflake subsequently mandated MFA for new customer configurations and introduced MFA enforcement options for existing tenants.

The AT&T Breach

The most significant individual breach in the campaign was AT&T. In July 2024, AT&T disclosed that call and text metadata records for "nearly all" of its customers had been stolen from a third-party cloud platform - confirmed to be Snowflake. The data included records of which phone numbers called or texted which other numbers between May and October 2022 and on January 2, 2023. While the content of calls and texts was not included, call detail records (CDR data) are considered highly sensitive: they reveal social graphs, business relationships, patterns of communication with journalists, attorneys, doctors, or government officials, and - for people under law enforcement surveillance - real-time intelligence about their activities.

The scale was extraordinary: AT&T serves approximately 110 million wireless customers. "Nearly all" of their call and text metadata, plus the cell tower location data associated with those records, was in the stolen dataset. AT&T paid the attacker approximately $370,000 to delete the data and provide proof of deletion. The attacker was identified as a member of the "Com" community (the same social network that produced Scattered Spider), an American citizen later arrested in connection with the AT&T breach.

The AT&T payment raised the same questions as every other ransom payment: you get a deletion promise, not a deletion guarantee. The attacker deleted what they showed AT&T, but AT&T had no way to verify that all copies were destroyed. The DOJ initially delayed AT&T's public disclosure for two months, citing national security concerns - the CDR data included calls involving federal agents and intelligence personnel.

[WARNING]
The Snowflake campaign demonstrated that the real attack surface for large enterprises increasingly lies in their SaaS and cloud tenants rather than their perimeter. An organization can have excellent endpoint detection, a hardened firewall, and strong network monitoring, and still lose hundreds of millions of customer records because an employee's home gaming PC was infected with an infostealer and they used the same browser profile for work. The infostealer log economy - where credentials harvested from consumer malware infections flow through underground markets and eventually reach corporate data platforms - connects consumer-facing malware to enterprise breach. Defenses: mandatory MFA on all cloud SaaS platforms (not optional), device trust/managed device requirements for accessing corporate platforms (credential from unmanaged device should not authenticate), monitoring for authentication from unusual locations or with suspicious timing, and separation of work and personal browser profiles.

ShinyHunters and the Broader Campaign

ShinyHunters is a threat actor group that has been active since at least 2020, responsible for numerous high-profile data breaches and data sales. The group operates primarily as financially motivated data thieves, targeting databases and data warehouses for sale. Previous ShinyHunters breaches included Tokopedia (91 million records, 2020), Microsoft GitHub repositories (2020), Wattpad (270 million records), and dozens of others.

In the Snowflake campaign, ShinyHunters was the primary actor posting stolen data for sale on BreachForums, the dark web forum that had replaced the seized RaidForums as the primary market for stolen data. The Ticketmaster data was listed for $500,000 initially. Subsequent data from other breached Snowflake tenants appeared over the following weeks as the campaign continued. The breadth of the campaign - multiple major companies affected through the same attack vector - reflected the group's systematic approach: obtain a large corpus of Snowflake credentials from infostealer logs, test all of them, monetize whichever tenants contained valuable data.

[IOC]
Snowflake credential campaign indicators: the initial attacker tooling was dubbed "FROSTBITE" by Mandiant (used for initial reconnaissance within compromised Snowflake tenants, including LS_FILES and query commands to identify accessible data). The credential source was infostealer logs specifically identified through Snowflake.com URL matching in log data. Authentication logs for affected Snowflake tenants showed login from IPs not associated with normal corporate egress, often residential or VPN infrastructure. Key indicators in Snowflake audit logs: logins from new IPs, high-volume SQL queries immediately after login, use of COPY INTO commands to stage data for extraction. Mandiant tracked the attacker as UNC5537. AT&T paid approximately $370,000 in Bitcoin to Connor Moucka (also known as "Judische"), a Canadian citizen arrested in October 2024 at the request of US law enforcement. ShinyHunters primary marketplace: BreachForums (v3, following seizure of v1 and v2). Snowflake's post-incident guidance mandated MFA and recommended reviewing authentication logs for all tenants.