What happened?
By mid-June 2024, the credential-driven campaign against Snowflake customer tenants had peaked: Mandiant attributed the operation to UNC5537, counted 165-plus victim organizations, and the crew’s data-leak habits had graduated from individual shakedown listings to a dedicated market. On June 19, when this post publishes, Mandiant’s public advisory and Snowflake’s customer report had just dropped, turning what each victim thought was a private extortion note into a named, tracked campaign.
Quick Answer: Mandiant’s June 19, 2024 advisory branded the Snowflake extortion wave UNC5537 — 165+ victims entered with infostealer credentials against MFA-less tenants, data extorted via listings and the “Snow:Bay” leak market; the campaign proved stolen-password economics scale to cloud data platforms.
Everything about UNC5537’s tradecraft was commodity. No zero-day, no sophisticated implant — infostealer logs bought or accumulated, credential-stuffing discipline against Snowflake login endpoints, and patience. Inside, the crew enumerated with standard SQL, staged exfil through cloud storage, and monetized through extortion. Mandiant’s profile emphasized their youth and financial motivation over state ties — a reminder that the barrier to a Fortune-500-scale breach in 2024 is a laptop, a wallet for logs, and tenants without MFA.
Snow:Bay and the industrialization of extortion
The campaign’s trademark was infrastructure discipline unusual for criminal crews: a dedicated leak marketplace researchers dubbed “Snow:Bay,” styled innocuously and hosted for buyers to browse and re-purchase datasets. It converted one-time extortion into an aftermarket. For defenders, that changes the assumption set: data does not resolve to “stolen once” but circulates with a price curve; notification obligations and monitoring must therefore be durable, not a single mail-merge apology.
| Date | Event |
|---|---|
| 2024-04→05 | Early intrusions accumulate; Santander and Ticketmaster disclosures (late May) made the campaign’s existence |
| 2024-06 | Peak volume: Advance Auto Parts, LendingTree/QuoteWizard and dozens more confirmed or listed |
| 2024-06-19 | Mandiant public advisory attributes campaign to UNC5537; Snowflake customer report details TTPs and countermeasures — this post publishes the same day |
| 2024-06→07 | Snow:Bay leak market observed; arrests follow later (an October 2024 Canadian bust charged an alleged participant) |
| 2024-H2 | Snowflake mandates MFA rollout; industry-wide SaaS identity hardening wave |
The two failures, again and again
Mandiant’s victim sampling found the same two factors in every confirmed intrusion: credentials already present in infostealer logs, and no MFA on the tenant. Auxiliary factors appeared — demo accounts with production mirrors, service accounts with long-lived keys, absent network policies — but the headline statistic was brutal in its simplicity. The campaign was preventable by a single control, executed consistently across every identity, human or machine.
- Identity hygiene is the perimeter: MFA on every tenant, phish-resistant where feasible; no exceptions for “internal only” or service identities.
- Credential-exposure monitoring: ingest stealer-log feeds; auto-burn any credential observed; treat exposure dates as rotation SLAs.
- Kill legacy surfaces: demo tenants, unused integrations, and 2024-era default-password policies are the entry points campaigns like this are made of.
- Extortion playbook: pre-determine legal, comms and law-enforcement paths; delay tactics and leak-market realities belong in the plan, not in improv.
FAQ
Was Snowflake itself compromised?
No — every confirmed intrusion used valid customer credentials against customer tenants. The platform’s contribution to the story was architectural (password-only access possible from anywhere) and later corrective: mandatory MFA, network policies, and customer guidance. But “not breached” and “blameless” diverged in the court of customer opinion, which is its own lesson for SaaS vendors.
Who exactly is UNC5537?
Mandiant’s profiling painted a financially motivated crew — young, North America- and Turkey-linked individuals by later reporting, opportunistic rather than state-directed. The October 2024 arrest of a Turkish-Canadian suspect (linked to Ticketmaster/Santander claims) added faces to the label. The significance is less the names than the model: low-skill actors industrializing high-yield credential abuse.
What is “Snow:Bay”?
A leak marketplace the crew stood up to sell stolen Snowflake-tenant datasets — some fresh, some recycled from earlier victims, some honestly repackaged, some padded. Its existence signals extortion economics maturing: resale infrastructure, customer segmentation (in the criminal sense), and pricing that decays with data age. Defenders monitoring such markets gain early warning of second-hand exposure.
Why this entry matters in the timeline
Placed after Ticketmaster (p05) and before CDK (p11), this entry captures the campaign at its named, quantified peak — the moment the industry stopped calling these “incidents” and started calling it a wave. The 165+ count, the attribution, the leak market: the full lifecycle of a modern cloud-extortion operation, executed without a single zero-day. For every security leader asked “are we doing enough about cloud,” June 19, 2024 supplied the year’s clearest answer metric: count your MFA-less identities. That number is your exposure.
The Mandiant TTP catalogue, condensed
The June 19 advisory is worth keeping on the bookshelf. Operationally: valid credentials, no MFA, broad network access; documented abuse of Snowflake’s SQL interfaces to enumerate and stage; exfil via cloud storage buckets and fronting services; extortion through leak-site listings and direct contact. Device trail: infostealer families years back, RDP and VPN footprints fading in and out. Countermeasure mapping is one-to-one: credential monitoring kills stage one, MFA kills stage two, network allow-listing kills stage three, and money-laundering friction (the crew cashed out crypto through standard rails) is where law enforcement eventually caught up.
Aftermath and aftershocks
The wave rewrote SaaS security baselines within months: Snowflake’s mandatory MFA (enforced in stages through late 2024), customer-facing security guides, and a wave of tenant audits across every data-platform vendor. Litigation and regulator interest followed the big names. And the UNC5537 playbook — stealer logs plus MFA-less tenants — remains the check-your-org exercise it always was; the crews copying it in 2025 merely changed the vendor logos. The campaign’s final lesson is the oldest one in the book, now priced at 560 million records: identity is the perimeter, and it is only as strong as its laziest non-MFA login.
Detection and response playbook
The Snowflake-related extortion campaign (UNC5537, per Mandiant) hit 165-plus customer tenants — not through a Snowflake breach, but through customer credentials stolen by infostealers and used against tenants that lacked MFA. The playbook is about the shared-responsibility seam, the widest gap in cloud security.
- Accept the uncomfortable ownership: your tenant credentials are yours. The entire campaign ran on stolen customer identities against unaudited tenant configurations. Inventory every SaaS and PaaS tenant, check MFA and conditional-access status for each, and treat any tenant without enforced MFA as an open finding — the attackers literally queried for them.
- Run the infostealer-to-SaaS chain detection. The credentials arrived from commodity malware on personal and corporate machines, then were replayed from unfamiliar infrastructure. Detections that matter: monitoring stealer-log feeds for your identities, SaaS login anomaly alerting (new device, new geography, impossible travel), and step-up authentication on sensitive tenant actions like user creation and data export.
- Detect the exfil signature: mass query and export. Attackers used legitimate-featured bulk access — large result sets, report exports, warehouse queries spanning whole tables. Baseline query volumes and export sizes per service account; sudden order-of-magnitude increases are the highest-signal exfiltration indicator in analytics platforms.
- Treat notification as ecosystem archaeology. Victims learned of exposure through attackers contacting their customers, and through Snowflake-hosted notifications — the cascade ran through the data relationships, like MOVEit. Maintained downstream-data maps again determined whether notification took days or months.
- Close the shared-responsibility gap contractually. Cloud providers will say, correctly, that tenant authentication is customer scope. Convert that boundary into engineering: MFA enforcement, key rotation schedules, service-account restrictions, and documented incident interfaces — so the next campaign finds no tenant where enforcement was optional.
Where this sits in the broader pattern
The campaign was the industrialization of three patterns this series tracks separately: the infostealer credential economy (Genesis, AnyDesk, the combo-list economy), the infostealer-to-production escalation path, and extortion without encryption (the Cl0p playbook from MOVEit applied to cloud tenants). The Snow:Bay leak site — attackers posting victim data with a mock marketplace — completed the industrialization: credential theft as procurement, extortion as storefront.
The shared-responsibility lesson landed hardest because the platform was never breached. Every control that failed belonged to customers who assumed the cloud implied the security of it. The same gap powers SaaS incidents across the era: tenants misconfigured, credentials over-scoped, MFA optional — invisible in provider dashboards, catastrophic in aggregate. Mandiant TTP catalogue for the campaign reads as a checklist of exactly these tenant-side defaults.
The industry aftermath — providers moving toward MFA-by-default and customers toward SaaS security posture management — is the structural response. For defenders, the consolidation is one sentence: cloud identity hygiene is not an IT ticket, it is the perimeter, and every tenant is now tested by attackers continuously whether or not it is tested by you.
The bottom line. One credential wave, 165-plus tenants, one rule ignored: enforce MFA everywhere, because attackers now enumerate the exceptions at scale. Your cloud tenants are being queried right now — the only variable is whether authentication, anomaly detection, and export baselines exist to make the query expensive. The shared-responsibility model is not a disclaimer; it is your job description.
For organizations mid-audit right now: the fastest meaningful check is a per-tenant list of identities without MFA and service accounts without export restrictions. That list, worked to zero, is the entire remediation this campaign demanded — everything else is verification of work that should already be routine.
Frequently Asked Questions
{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”Was Snowflake itself breached in the 2024 extortion campaign?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”No. Attackers used customer credentials stolen by infostealer malware to access Snowflake customer tenants that lacked multi-factor authentication and other hardening. Snowflake infrastructure itself was not compromised.”}},{“@type”:”Question”,”name”:”How many organizations were affected by the Snowflake credential campaign?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Over 165 customer organizations were extorted, including high-profile breaches like Ticketmaster and Santander data appearing for sale, all traced to stolen customer credentials rather than a platform breach.”}},{“@type”:”Question”,”name”:”How do you prevent Snowflake-style SaaS account compromises?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Enforce MFA on every tenant, monitor credentials in stealer logs, alert on anomalous logins and bulk exports, restrict service accounts, and maintain downstream-data maps for fast customer notification.”}}]}
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- Verkada Camera Breach: 150,000 Feeds Behind One Credential
- Snowflake-Related Arrests: UNC5537’s Kitchener Pinch
- Internet Archive Breach and DDoS: 31M Accounts, One Pop-Up
