Hacker behind Snowflake customer data breaches remains active

The report describes an ongoing criminal campaign by an actor known as "Judische" who used infostealer malware to harvest credentials and compromise Snowflake customer environments in April, potentially exposing data from up to 165 customers and resulting in extortion of dozens of victims (estimated $2M–$2.7M). It notes coordination with another attacker (John Binns), names several affected organizations, and states the actor remains active and continues to target SaaS providers.