Threat Intel
Canadian Threat Actor Pleads Guilty in Snowflake and AT&T Extortion Campaigns
A 26-year-old Canadian national has entered a guilty plea for computer fraud and extortion schemes targeting over 165 organizations via stolen Snowflake credentials. The actor also admitted to the massive exfiltration of AT&T call and text metadata. SecOps teams must review identity provider settings, enforce rigorous multi-factor authentication, and monitor for unauthorized cloud data access.
What Happened
Connor Riley Moucka, a 26-year-old operator known online as "Judische" and "Waifu," has pleaded guilty to charges related to large-scale computer fraud and corporate extortion. Operating between February and October 2024, Moucka and co-conspirators leveraged compromised credentials to access cloud storage environments hosted by Snowflake. Additionally, the actor admitted to stealing the call and text logs of more than 100 million AT&T customers.
Impact and Scope
The campaign compromised at least 165 enterprise customers utilizing Snowflake's cloud data platform, resulting in the theft of terabytes of sensitive corporate and consumer data. High-profile victims included major brands such as Ticketmaster, LendingTree, Advance Auto Parts, and Neiman Marcus. Exfiltrated data types spanned financial records, PII including social security and passport numbers, payroll documents, and telecommunications metadata.
Attack Methodology
The threat actors gained unauthorized access primarily by targeting Snowflake customer accounts that failed to enforce multi-factor authentication (MFA). Once inside the environments, the adversaries downloaded massive volumes of proprietary data and subsequently launched extortion demands against the affected organizations under various online aliases.
Defensive Recommendations
- Enforce mandatory, phishing-resistant multi-factor authentication (MFA) across all administrative and standard user accounts for cloud data warehouses and SaaS platforms.
- Audit identity and access management (IAM) policies to detect accounts lacking proper authentication controls or utilizing legacy static passwords.
- Monitor cloud storage access logs for anomalous data exfiltration patterns, high-volume API requests, and unauthorized session establishment.
- Implement strict credential rotation policies and deploy continuous monitoring solutions to detect credential stuffing and brute-force attempts against cloud perimeters.
Related articles
Egregor Ransomware: Recent TTPs and Defensive Actions
Egregor ransomware operators have intensified attacks, leveraging Windows PowerShell and remote desktop protocols to spread across networks. The latest campaigns target unpatched systems and use double‑extortion tactics. Defenders should harden RDP, enforce least‑privilege, and monitor for anomalous PowerShell activity.
Read briefing
PhantomRaven: LLM‑Generated JavaScript Stealer Targeting Bug Bounty Hunters
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer engineered by a financially motivated threat actor posing as a bug‑bounty researcher. The tool harvests credentials and sensitive data from compromised web pages, and its code is distributed via malicious sites and phishing campaigns. Defenders should audit third‑party scripts, enforce strict CSP, and monitor for anomalous data exfiltration.
Read briefing
Armenian National Sentenced to Federal Prison for Ryuk Ransomware Operations
A US federal court has sentenced 35-year-old Armenian national Karen Vardanyan to 24 months in prison and ordered him to pay over $1.2 million in restitution for his participation in Ryuk ransomware campaigns. Vardanyan pleaded guilty to conspiracy and computer fraud charges stemming from attacks conducted between 2019 and 2020.
Read briefing
August 24th Threat Intel: Latvia Breach, AI‑Driven Attacks, and Critical Vulnerabilities
The latest Check Point research bulletin highlights a sweeping data breach at Latvia’s Road Traffic Safety Directorate, affecting over 1.2 million citizens and 200,000 organisations. Sakura Internet exposed up to 1.36 million customer accounts through a compromised rental‑server environment. A Canadian children’s hospital suffered a third‑party data leak, while Berlin’s urban ministries were isolated after a security incident. AI‑driven threats are on the rise: an autonomous GitHub Actions agent stole Snowflake tokens, and U.S. authorities warn of AI‑assisted attacks on Siemens S7 industrial c
Read briefing