Back
Outfaze Security Team

Outfaze Security Team

Snowflake Account Attacks: Lessons From UNC5537

Snowflake Account Attacks: Lessons From UNC5537

In June 2024, Mandiant described UNC5537 compromises of Snowflake customer instances. Its investigations traced the incidents it handled to stolen customer credentials rather than a breach of Snowflake's enterprise environment.

Three conditions repeatedly increased exposure: credentials previously captured by infostealer malware remained valid, affected accounts lacked MFA, and network allow lists were absent.

Old credentials reached a high-value cloud data store

Some credentials had been stolen years earlier. Once used successfully, the actor could enumerate databases, query tables, stage records, and exfiltrate data through legitimate interfaces.

The campaign demonstrated why a clean authentication event is not automatically a trusted one. Cloud data platforms need strong identity policy, network restrictions, service-account governance, and detailed activity monitoring.

Harden the account and observe the data plane

Enforce MFA for human users, rotate exposed secrets, constrain network locations, and remove dormant accounts. Service identities should have narrowly defined roles, protected credentials, owners, and usage baselines.

Monitor unusual client tools, source networks, authentication patterns, large queries, staging operations, bulk exports, and changes to roles or policies. Keep enough history to investigate credentials that may have been stolen long before use.

  • Treat infostealer exposure as an enterprise credential incident.
  • Do not leave interactive passwords valid indefinitely.
  • Use network policy as an additional boundary.
  • Connect identity alerts to data-access investigation.

Put the lesson into practice

  1. Inventory Snowflake users, service accounts, roles, and owners.
  2. Enforce MFA and rotate at-risk credentials.
  3. Apply appropriate network allow lists or policies.
  4. Baseline and alert on high-volume data access.
  5. Create a cloud data-theft investigation playbook.

Related Outfaze guidance

Authoritative sources