The Snowflake Campaign Ends in a Guilty Plea. The Conditions That Enabled It Have Not Changed

Connor Riley Moucka pleaded guilty on 5 August in the Western District of Washington to four counts covering computer fraud, wire fraud, aggravated identity theft and a related conspiracy. He is 26 and from Kitchener, Ontario. He was extradited from Canada in July 2025 after consenting to surrender that March. Sentencing is set for 27 October. He faces a mandatory minimum of two years on the identity theft count and up to thirty on the rest.

The Justice Department describes the target as a U.S.-based software-as-a-service company and does not name it. The details are unambiguous: over 165 victim organisations, billions of customer records, activity running February to October 2024. That is the campaign Mandiant documented as UNC5537 against Snowflake customer instances.

Worth noting for the record, because it shapes how these cases work: the original October 2024 indictment charged conduct against at least ten victim organisations. The plea covers over 165. The gap between what gets charged and what gets established is where most of the real scope of a campaign sits.

What Actually Happened

Snowflake was never breached. Mandiant found no evidence that access to customer accounts came from a compromise of Snowflake's own environment, and every incident it responded to traced back to stolen customer credentials.

Those credentials came from infostealer logs. VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER all featured. At least 79.7 per cent of the accounts the actor used had prior credential exposure, and the earliest infection date behind a working credential went back to November 2020.

Read that again. A password stolen by commodity malware in 2020 was still valid, still unrotated, and still sufficient to walk into a production data warehouse four years later.

Mandiant identified three conditions that turned exposed credentials into 165 compromises:

• the affected accounts had no multi-factor authentication, so a username and password were sufficient;
• the credentials had never been rotated, in some cases for four years;
• there were no network allow lists restricting access to trusted locations.

None of those is a vulnerability. All three are configuration.

The Contractor Problem

The detail that deserves more attention than it got in 2024: in several of these investigations, the infostealer infection did not happen on a corporate device at all. It happened on contractor systems that were also used for personal activity, including gaming and pirated software downloads.

A contractor working across several client environments, on a personal or unmonitored laptop, holding administrative credentials for all of them, is a single point of failure that most access reviews never look at. The device is outside your EDR, outside your patching, outside your conditional access, and inside your data warehouse.

If you engage contractors for any platform holding significant data, that is the question to ask this week. Not whether they have MFA on the account, but what machine the credential lives on.

What the Actor Did Once Inside

The tradecraft was unremarkable, which is the point. Access came through Snowflake's own web interface and command line client. Reconnaissance ran through a custom utility Mandiant tracks as FROSTBITE, in both .NET and Java builds, listing users, roles, IP addresses, session identifiers and organisation names. The actor also used DBeaver Ultimate, an ordinary database management tool, to run queries across instances.

Exfiltration used native Snowflake commands and nothing else. SHOW TABLES to enumerate. SELECT to pull tables of interest. CREATE TEMPORARY STAGE to build a staging area that deletes itself when the session ends. COPY INTO to move data there as gzipped CSV. GET to retrieve it.

Every one of those is a legitimate command a data engineer runs daily. There is no malware on the endpoint to catch, no exploit to patch, no anomalous binary to flag. The detection opportunity is entirely in the access pattern and the client application identifier, which is why Mandiant's hunting guidance keyed on things like an unrecognised client app string rather than on anything resembling a signature.

What This Cost

The conspirators took over $2.5 million in ransom payments. Moucka personally received at least $495,000. Victim companies recorded over $9.5 million in actual losses, a figure that excludes anything suffered by their customers, of whom there were at least 100 million.

Stolen data was advertised on BreachForums, Exploit.in and XSS.is, and on Telegram. In at least one case Moucka re-extorted a victim, threatening further disclosure, and used the stolen data of a government officer and members of a former government officer's immediate family to do it.

The categories of data involved included call and text history records, banking and financial information, payroll records, DEA registration numbers, driver's licence numbers, passport numbers and social security numbers.

It Is Not Over

Co-defendant John Erin Binns, charged in the same indictment, is not in U.S. custody. The case page for the Western District of Washington lists a trial date of 19 October 2026 before Judge Lauren King.

More to the point, nothing about the method has been retired by this plea. Mandiant's assessment in 2024 was that the actor would continue the same pattern against other SaaS platforms, and the ingredients are all still in circulation: a robust infostealer market, enormous volumes of harvested credentials available free or cheap, and a very large number of SaaS tenants where MFA is optional, credentials are old and access is not restricted by network.

The Justice Department frames the plea as part of Operation Riptide, its enforcement campaign against cybercrime infrastructure and financial networks, and notes that Americans reported over $20 billion in cybercrime losses last year, up 26 per cent in a single year.

Do This Now

Three checks, in order of how much they would have mattered in 2024.

Enforce MFA on every SaaS platform holding data you care about, without exception for service accounts and integrations. The campaign worked because authentication required only what the infostealer already had.

Rotate credentials that predate your current policy, and find out how old the oldest working one is. If a credential from four years ago still authenticates, you have the same exposure regardless of what your policy document says.

Apply network allow lists to your crown jewels. A valid credential presented from an unexpected location should not succeed, and on most major SaaS platforms this is a configuration toggle rather than a project.

Then one longer piece of work: get visibility of credential exposure for your own domains in infostealer logs, and treat a hit as a rotation trigger rather than an alert to file.

Bottom Line

A twenty-six year old with commodity infostealer logs, a database GUI and no novel tooling compromised 165 organisations and reached the data of a hundred million people. Mandiant said at the time that the campaign involved nothing particularly novel or sophisticated, and the guilty plea does not change that assessment. It confirms it.

The vendor was not breached. The customers were, through three settings that were never turned on. Those settings are still available, and in a great many estates they are still off.