Snowflake customers not using MFA are not unique – over 165 of them have been compromised

Mandiant attributes a campaign (UNC5537) to a financially motivated crime crew that exfiltrated data from roughly 165 Snowflake customer accounts by using valid credentials stolen via infostealer malware (e.g., VIDAR, REDLINE, RISEPRO, RACCOON, LUMMA, METASTEALER). The attackers used a reconnaissance/exfiltration utility tracked as Frostbite (aka "rapeflake") and tools like DBeaver, exploited contractor/shared devices, and targeted accounts lacking MFA and network allow-lists; stolen data began appearing for sale by late May.