Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Stolen credentials → no-MFA Snowflake → mass tenant exfil (2024)

Infostealer logs from third-party machines yielded credentials for many Snowflake tenants. Tenants without enforced MFA / IP allow-lists were directly queried; dozens of customer data sets exfiltrated.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target organisation uses Snowflake. MFA + IP allow-list not enforced tenant-wide. Some service accounts use static credentials without rotation, stored on user machines.

§ Steps

  1. 01
    Bulk export critical tablesExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Sell / leak data; ransom tenantImpact
    T1486— Data Encrypted for Impact
  3. 03
    List databases / schemas / tablesDiscovery
    T1087— Account Discovery
  4. 04
    Grep logs for *.snowflakecomputing.comReconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  5. 05
    Acquire infostealer logs (forum / Telegram)Resource Development
    T1583— Acquire Infrastructure
  6. 06
    Authenticate as tenant userCredential Access
    APT-SNOWFLAKE-2024— Snowflake Stolen-Credential Mass Theft (2024)

§ References

§ Frequently asked

What is the "Stolen credentials → no-MFA Snowflake → mass tenant exfil (2024)" attack path?
Infostealer logs from third-party machines yielded credentials for many Snowflake tenants. Tenants without enforced MFA / IP allow-lists were directly queried; dozens of customer data sets exfiltrated. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bulk export critical tables (T1041) — a exfiltration primitive. Assumed environment: target organisation uses Snowflake.
What is the final impact of this kill-chain?
The final step lands on Authenticate as tenant user (APT-SNOWFLAKE-2024), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers