Hacker extracts corporate data from Snowflake: two accomplices arrested, the third is a US soldier
A US Army soldier, identified by the alias "Kiberphant0m," is the mastermind behind a series of cyberattacks against dozens of Snowflake's corporate clients, the popular cloud storage service. The individual, currently at large, exploited stolen credentials to access repositories of sensitive data protected only by username and password, without two-factor authentication.
Quick Response
- Kiberphant0m is suspected of being a US soldier stationed in South Korea
- He stole data from AT&T, Verizon, and other giants, including call logs of Trump and Harris
- Two accomplices arrested: Alexander Moucka (Canada) and John Erin Binns (USA)
- He threatened to publish government data if AT&T does not pay
- He sold access to government and corporate servers with default credentials
The attack on Snowflake and the prominent victims
At the end of 2023, hackers discovered that many companies had uploaded enormous amounts of sensitive data to Snowflake accounts protected only by passwords. Among the most prominent victims, AT&T, which revealed in July the theft of personal information and telephone records of approximately 110 million people. To prevent the spread of the data, the company paid $370,000 to a hacker.
The identity of the hacker soldier
An in-depth analysis of the Telegram and Discord channels used by Kiberphant0m suggests that he is a US soldier stationed in South Korea. The individual, active since at least January 2024 on BreachForums, has posted over 4,200 messages seeking to recruit people to distribute malware in an IoT botnet.
The public threats and data sales
Immediately after the arrest of Alexander Moucka, Kiberphant0m published on BreachForums what he claims to be the call logs of Donald Trump and Kamala Harris, threatening to make them public if AT&T does not contact the hackers. On the same day, he published a data scheme that he claims to have obtained from the NSA through the hack of AT&T.
The criminal activities and aliases
Kiberphant0m is linked to several aliases, including "Buttholio," "Reverseshell," and "Proman557." These accounts have been active on various forums and Telegram channels related to cybercrime, DDoS, and malware sales. Investigations show that the individual has sold access to government and corporate servers with default credentials, including those of a major US defense contractor.
The arrest of accomplices and ongoing investigations
Alexander Moucka, also known as Connor Riley Moucka, was arrested on October 30 in Canada with a provisional arrest warrant from the United States. Moucka is charged with 20 counts related to the Snowflake breaches. John Erin Binns, another suspect, is currently detained in Turkey. Investigations continue to identify and arrest Kiberphant0m.
The impact on companies and cloud security
This case underscores the importance of cloud security and the adoption of robust authentication measures. Companies using services like Snowflake must implement advanced cyber insurance and incident response solutions to protect sensitive data and respond quickly to breaches.
Legal implications and future threats
Kiberphant0m's public threats to publish government and sensitive data raise concerns about national security and the protection of personal data. Authorities must collaborate internationally to combat these criminal activities and ensure that the perpetrators are brought to justice.
The need for a managed SOC
This case highlights the importance of a managed Security Operations Center (SOC) to monitor and respond to cyberattacks in real-time. Companies must invest in Managed Detection and Response (MDR) solutions to identify and neutralize threats before they can cause significant damage.
The protection of sensitive data
Companies must implement Data Loss Prevention (DLP) solutions to protect sensitive data and prevent its unauthorized dissemination. It is crucial to adopt advanced security measures to ensure compliance with regulations such as NIS2 and DORA.
The market for stolen credentials and the responsibility of vendors
The Snowflake case highlights a structural problem in the market for stolen credentials. According to Flashpoint, the sale of access to corporate and government servers with default credentials is a rapidly expanding business. Snowflake, like other cloud service vendors, now faces pressure to implement stricter security measures, including the mandatory use of two-factor authentication (2FA) for all accounts, including administrative ones.
The impact on cyber insurance premiums
The incident has already influenced cyber insurance premiums. Insurance companies are re-evaluating the risks associated with storing sensitive data on cloud platforms without adequate protections. Analysts estimate an average increase of 15-20% in premiums for companies using services similar to Snowflake, with explicit clauses excluding damages resulting from the lack of multi-factor authentication.
The challenges of incident response in international contexts
The complexity of incident response in this case is amplified by the presence of actors in different jurisdictions. Investigations involve Canadian, Turkish, and US authorities, with extradition procedures that could take months. This delay can exacerbate reputational and financial damage for the victims, underscoring the need for collaborative frameworks such as those promoted by the NIS2 directive.
The vulnerability of legacy systems and the importance of SIEM
The use of default credentials and the absence of 2FA reveal a dangerous dependence on legacy systems. According to a Gartner study, 70% of breaches in 2024 exploited this flaw. A properly configured SIEM system could have detected anomalies in access, but its effectiveness depends on integration with advanced identity access management (IAM) solutions.
The future of crypto institutional custody
This case also raises questions in the crypto sector. Stolen credentials could be used to access institutional wallets, highlighting the need for more secure institutional custody solutions. The MiCA regulation already requires periodic audits, but many providers still need to comply with crypto AML compliance standards.