Canadian Man Arrested in Snowflake Data Extortions
ID: faa81622-b654-5197-a777-6860539a2224
STIX ID: report--faa81622-b654-5197-a777-6860539a2224
Feed Name: Krebs on Security
Executive summary: The report details a 2023–2024 criminal campaign by UNC5537 operators who harvested stolen Snowflake credentials and exploited misconfigured Snowflake instances to exfiltrate and extort sensitive data from over 160 customers (including AT&T, TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus). It links alleged operators Alexander Moucka (Judische/Waifu) and John Erin Binns (IRDev/IntelSecrets) to SIM swapping, vishing, botnet-enabled operations and the sale of large datasets on cybercrime forums, and describes arrests, an unsealed U.S. indictment, and ongoing investigative findings.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.