#datatheft

The Keenadu malware family has surfaced in Android firmware, system apps, and trojanised Play Store downloads, enabling full device compromise and silent data theft across thousands of devices.

Source: BleepingComputer

Targeting Snowflake Customer Instances for Extortion and Data Theft, UNC5537 Overview. Mandiant has discovered a threat campaign that targets Snowflake client database instances with the goal of extortion and data theft. This campaign has been discovered through Google incident response engagements and threat intelligence collections. The multi-Cloud data warehousing software Snowflake can store and analyze massive amounts of structured and unstructured data.

Mandiant is tracking UNC5537, a financially motivated threat actor that stole several Snowflake customer details. UNC5537 is using stolen customer credentials to methodically compromise Snowflake client instances, post victim data for sale on cybercrime forums, and attempt to blackmail many of the victims.

Snowflake instance According to Mandiant’s analysis, there is no proof that a breach in Snowflake’s enterprise environment led to unauthorized access to consumer accounts. Rather, Mandiant was able to link all of the campaign-related incidents to hacked client credentials.

Threat intelligence about database records that were later found to have come from a victim’s Snowflake instance was obtained by Mandiant in April 2024. After informing the victim, Mandiant was hired by the victim to look into a possible data theft affecting their Snowflake instance. Mandiant discovered during this investigation that a threat actor had gained access to the company’s Snowflake instance by using credentials that had previously been obtained through info stealer malware.

Using these credentials that were taken, the threat actor gained access to the customer’s Snowflake instance and eventually stole important information. The account did not have multi-factor authentication (MFA) activated at the time of the intrusion.

Following further intelligence that revealed a wider campaign aimed at more Snowflake customer instances, Mandiant notified Snowflake and potential victims via their Victim Notification Programme on May 22, 2024.

Snowflakes Mandiant and Snowflake have notified about 165 possibly vulnerable organizations thus far. To guarantee the security of their accounts and data, these customers have been in direct contact with Snowflake’s Customer Support. Together with collaborating with pertinent law enforcement organizations, Mandiant and Snowflake have been undertaking a cooperative investigation into this continuing threat campaign. Snowflake released comprehensive detection and hardening guidelines for Snowflake clients on May 30, 2024.

Campaign Synopsis According to Google Cloud current investigations, UNC5537 used stolen customer credentials to gain access to Snowflake client instances for several different organizations. The main source of these credentials was many info stealer malware campaigns that compromised systems controlled by people other than Snowflake.

As a result, a sizable amount of customer data was exported from the corresponding Snowflake customer instances, giving the threat actor access to the impacted customer accounts. Subsequently, the threat actor started personally extorting several of the victims and is aggressively trying to sell the stolen consumer data on forums frequented by cybercriminals.

Mandiant Mandiant discovered that most of the login credentials utilized by UNC5537 came from infostealer infections that occurred in the past, some of which were from 2020. Three main causes have contributed to the multiple successful compromises that UNC5537’s threat campaign has produced:

Since multi-factor authentication was not enabled on the affected accounts, successful authentication just needed a working login and password. The credentials found in the output of the infostealer virus were not cycled or updated, and in certain cases, they remained valid years after they were stolen. There were no network allow lists set up on the affected Snowflake client instances to restrict access to reliable sources. Infostealer Mandiant found that the first infostealer malware penetration happened on contractor computers that were also used for personal purposes, such as downloading pirated software and playing games. This observation was made during multiple investigations related to Snowflake.

Customers that hire contractors to help them with Snowflake may use unmonitored laptops or personal computers, which worsen this initial entry vector. These devices pose a serious concern because they are frequently used to access the systems of several different organizations. A single contractor’s laptop can enable threat actors to access numerous organizations if it is infected with infostealer malware, frequently with administrator- and IT-level access.

Identifying The native web-based user interface (SnowFlake UI, also known as SnowSight) and/or command-line interface (CLI) tool (SnowSQL) on Windows Server 2022 were frequently used to get initial access to Snowflake customer instances. Using an attacker-named utility called “rapeflake,” which Mandiant records as FROSTBITE, Mandiant discovered more access.

Mandiant believes FROSTBITE is used to conduct reconnaissance against target Snowflake instances, despite the fact that Mandiant has not yet retrieved a complete sample of FROSTBITE. Mandiant saw the use of FROSTBITE in both Java and.NET versions. The Snowflake.NET driver communicates with the.NET version. The Snowflake JDBC driver is interfaced with by the Java version.

SQL recon actions by FROSTBITE have been discovered, including a listing of users, current roles, IP addresses, session IDs, and names of organizations. Mandiant also saw UNC5537 connect to many Snowflake instances and conduct queries using DBeaver Ultimate, a publicly accessible database management tool.

Finish the mission Mandiant saw UNC5537 staging and exfiltrating data by continuously running identical SQL statements on many client Snowflake systems. The following instructions for data staging and exfiltration were noted.

Generate (TEMP|TEMPORARY) STAGE UNC5537 used the CREATE STAGE command to generate temporary stages for data staging. The data files that are loaded and unloaded into database tables are stored in tables called stages. When a stage is created and designated as temporary, it is removed after the conclusion of the creator’s active Snowflake session.

UNC5537 Credit Since May 2024, Mandiant has been monitoring UNC5537, a threat actor with financial motivations, as a separate cluster. UNC5537 often extorts people for financial benefit, having targeted hundreds of organizations globally. Under numerous aliases, UNC5537 participates in cybercrime forums and Telegram channels. Mandiant has recognized individuals who are linked to other monitored groups. Mandiant interacts with one member in Turkey and rates the composition of UNC5537 as having a moderate degree of confidence among its members who are located in North America.

In order to gain access to victim Snowflake instances, Attacker Infrastructure UNC5537 mostly leveraged Mullvad or Private Internet Access (PIA) VPN IP addresses. Mandiant saw that VPS servers from Moldovan supplier ALEXHOST SRL (AS200019) were used for data exfiltration. It was discovered that UNC5537 was storing stolen victim data on other foreign VPS providers in addition to the cloud storage provider MEGA.

Prospects and Significance The campaign launched by UNC5537 against Snowflake client instances is not the product of a highly advanced or unique method, instrument, or process. The extensive reach of this campaign is a result of both the expanding infostealer market and the passing up of chances to further secure credentials:

UNC5537 most likely obtained credentials for Snowflake victim instances by gaining access to several infostealer log sources. There’s also a thriving black market for infostealerry, with huge lists of credentials that have been stolen available for purchase and distribution both inside and outside the dark web.

Infostealers Multi-factor authentication was not necessary for the impacted customer instances, and in many cases, the credentials had not been changed in up to four years. Additionally, access to trusted locations was not restricted using network allow lists.

This ad draws attention to the ramifications of a large number of credentials floating throughout the infostealer market and can be a sign of a targeted attack by threat actors on related SaaS services. Mandiant predicts that UNC5337 will carry on with similar intrusion pattern, soon focusing on more SaaS systems.

This campaign’s wide-ranging effects highlight the pressing necessity for credential monitoring, the ubiquitous application of MFA and secure authentication, traffic restriction to approved sites for royal jewels, and alerts regarding unusual access attempts. See Snowflake’s Hardening Guide for additional suggestions on how to fortify Snowflake environments.

a  hush - SHH, so  gentle  one  could  mistake  it  for  a  whisper  from  on high, from  a  messenger  with  divine  purpose. but  the  face  above  is  by  no  means  angelic, it’s  time-worn, creased  in  places  with  a  thick  beard  outlining  a  heavy  set  mouth  and  jaw  and  long  grayed  morals. his  hands  are  sunk  beside  her  head  then  they  move  again  lower  on  her  body. his  intention  had  been  to  cover  her  up  with  their  blanket  as  it’d  slid  off  her  shoulders  sometime  while  he’d  been  preoccupied  in  the  shower. just  before  they  tuck  the  comfortable  thing  back  beneath  her  chin  they  bend  to  press  a  kiss  to  her  neck, tasting  a  sweet-bitterness  and  effectively  ending  the  scene  with  an  air  of  domesticity.        “ didn’t  mean  to  wake  you. ”

This...wasn’t what the priest had been expecting at all. In the wall of the Carpathians that bordered the periphery of Transylvania proper--Dracula’s domain--his legions of demons dwindled only to surge with demonic fury that more that were slain. A hoard of chiropteran demons blotted out the moon as Sypha stood at the base of a forest, the newly dead the trap that would see them sundered by a means befitting their name.

something  about  the  chill   &   the  stale  taste  in  the  air  tells  angela  she  is  underground .     her  hair  droops  sadly  out  of  its  ponytail ,     a  matted  mess  of  sweat  and  ice - cold  water .       she  knows  they  know  about  the  accelerated  healing  she  has .       she  knows  they  know  that  it  only  means  she  will  break  harder ,     once  they’ve  drawn  out  her  suffering  long  enough .       ironic  that  the  technology  she  used  for  longevity  will  draw  her  death  out  longer .       she  heals  fast  enough  that  any  bruise  they  give  her  now  will  be  unblemished  flesh  in  a  matter  of  hours  instead  of  days .       eventually ,     if  o’deorain  hasn’t  already ,     talon  will  figure  out  a  way  to  fry  the  nanites  out  of  her  blood       (   a  little  stream  of  it  crusts  black  in  the  corner  of  her  cracked  lips   )       and  make  her  as  mortal  as  she  ever  was .       the  little  camera  in  its  upside - down  dome  monitoring  her  blinks  its  red  eye .

how  long  has  it  been  since  she’d  been  captured ?       how  long  since  the  halo  was  ripped  from  her  head  and  smashed  underfoot ,     her  beloved  staff  snapped  into  three  disparate  pieces  as  its  circuit  innards  spilled  like  broken  strings  between ?       angela  wonders  if  counting  the  seconds  by  the  blink - blink - blink  of  the  camera  would  tell  her ,     but  she  knows  it’s  useless .       even  though  she  hasn’t  broken  yet ,     hasn’t  offered  any  pertinent  information  about  anyone  she’s  affiliated  with ,     has  made  a  tangible  effort  not  to  utter  a  sound  outside  of  the  ragged  sobs  they’ve  ripped  from  her  throat     –––––     the  effort  of  withholding  the  screams  they  want  has  cost  her  time .       she’s  drifted  in   &   out  of  consciousness .       for  all  she  knows ,     these  four  concrete  walls  could  have  been  echoing  with  her  agony  for  the  last  six  hours  or  the  last  six  days .

blink!  goes  the  camera .     angela  rattles  an  exhale ,     curled  up  in  the  corner  furthest  from  the  door ,     drenched  and  shivering ,     her  right  hand     /     her  𝐬𝐮𝐫𝐠𝐞𝐨𝐧’𝐬  𝐡𝐚𝐧𝐝  clutched  vainly  to  her  breast ,     every  fragile  bone  snapped  meticulously  and  the  skin  a  sickly  bloom  of  green   &   black .       she  knows  that  moira  is  probably  the  one  who  let  it  slip  that  the  injuries  that  take  the  slowest  to  heal  even  with  her  nanotechnology  are  bone  breakages .       (   𝐚  𝐥𝐨𝐯𝐞𝐫  𝐰𝐡𝐨  𝐡𝐚𝐬  𝐤𝐧𝐨𝐰𝐧  𝐲𝐨𝐮𝐫  𝐛𝐨𝐝𝐲  𝐢𝐧𝐭𝐢𝐦𝐚𝐭𝐞𝐥𝐲  𝐤𝐧𝐨𝐰𝐬  𝐛𝐞𝐬𝐭  𝐡𝐨𝐰  𝐭𝐨  𝐛𝐫𝐞𝐚𝐤  𝐢𝐭 .   )       she  loses  herself  in  the  rumination  of  what  else  moira  has  told  about  her  enhancements     /     what  other  information  gleaned  from  long  nights  shared  in  the  lab  and  in  the  bedroom  have  made  it  easier  for  them  to  twist  her  arm  until  she  cries  uncle .

the  next  time  angela  looks  up ,     the  camera  has  stopped  blinking .       might  as  well  that  she  hasn’t  tried  to  count  the  seconds  with  its  flashes .       saves  some  of  that  lauded  brain’s  energy ,     though  a  part  of  her  wishes  she  had  been  counting  just  to  have  something  to  fixate  on  in  this  liminal  hell .       something  in  the  back  of  her  mind  stirs  as  she  curls  into  a  tighter  ball ,     the  unceasing  red  eye  of  the  camera  blurry  behind  her  lashes .       the  concrete  floor  is  so  cool  against  the  fever - flushed  skin  of  her  cheek .       the  shadow  of  whatever  thought  angela  had  half - formulated  stirs  again .       pixels   &   dancing  lines  of  code .       purple  silhouettes .       long  nails   &   circuitry  seared  into  dark  skin ,     the  smirk  of  someone  that  sees  everything .       

bloodshot  eyes  lock  onto  the  beady  red  stare  on  the  ceiling .          ❝     i  know  you’re  watching .     ❞

vine  starters     💥     accepting   !

     “   and   ?   “   bullet  rolls  between  her  fingers   ,   attention  remaining  distant   ,   indifferent   …   before  she  pockets  ammunition  and  meets  sombra’s  gaze   .   “   y’know   ,   it’s  rude  to  come  to  a  lady  eatin’  food  and  not  offer  her  some   .   common  courtesy   ,   ain’t  it   ?   “

     she  doesn’t  care  either  way   ;   a  hint  of  a  smirk  on  her  face  makes  it  clear   .   can’t  help  but  want  to  test  this  theory   —    ashe  does  the  very  thing  that  almost  caused  croissant  to  fall  in  the  first  place   .

@datatheft  – meme – accepting. 

AUDIBLE TSK FLEES plump petals, antagonistic honey hues holding those that implored further statement— without waiver. ( she was once flora in bloom soaked in ichor-like rot. night bathed / sun craving. ) assassin knew the persecution behind being forced to kneel to the point it broke brittle bone. ( being forced to kill her husband, or attack her former mentor. but for what? to be the most deadly sniper in the world? ) like a strong heel to her back, or a palm around her throat. this prison shackled freedom within a tightly wrapped package cleverly disguised as a career. she would not be their weapon any more– enough blood stained lithe digits. guilt ridden, guilt wrought– wrecked by the notion she would never be  that version of amélie lacroix again.

 after a certain point fear no longer affected her the way it used to. she harnessed it like she would any other weapon– kept it close and recalled the damage it had done in the past. echoes of pleas she had murmured throughout the process of her reconditioning, and lastly how stoic those scientists could remain. unflinchingly loyal to their cause. she retained their mask even now; perfecting the guise of loyalty until it no longer suited her.  no longer effected by their conditioning  amélie could devise plans of her own.

“ – we won’t have to bend our knees, olivia.  we just need to gather the resources necessary to take them down from within. you’re good at that, no? ”