Malware

rapeflake

rapeflake is an attack tool referenced in reporting on the 2024 Snowflake-related data theft and extortion campaign. The available content provides only limited, high-confidence information about the tool itself: it was identified in incidents tied to Snowflake customer compromises, but detailed technical information about its functionality remains unknown. The broader campaign involved threat actors using credentials stolen via infostealer malware to access Snowflake environments, particularly customer accounts that did not enforce MFA/2FA, often from commercial VPN infrastructure. Reporting associates these incidents with ShinyHunters-related activity and notes impacts to organizations including Ticketmaster, with other Snowflake customers such as Anheuser-Busch and State Farm also mentioned as potential victims. One mention states the tool name is similar to the "RapeFlake" tool referenced during Snowflake data theft attacks. No specific capabilities, infection vector, platform support, or confirmed indicators of compromise for rapeflake itself are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

"a threat actor has been observed using stolen customer credentials to target organizations utilizing Snowflake databases"; "exploited credentials stolen via infostealer malware to infiltrate accounts that lacked multi-factor authentication (MFA)."

T1133External Remote ServicesEvidence1

"targeting Snowflake’s cloud data platform"; "infiltrate accounts"; discussion of Snowflake LOGIN_HISTORY and SSO/MFA enforcement.

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1133External Remote ServicesEvidence1

"targeting Snowflake’s cloud data platform"; "infiltrate accounts"; discussion of Snowflake LOGIN_HISTORY and SSO/MFA enforcement.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Collection

1 technique

T1213Data from Information RepositoriesEvidence1

"campaign focused on data theft"; "stolen 50 billion customer call and text records"; guidance to detect "suspicious or unauthorized queries" and "data exfiltration attempts" via QUERY_HISTORY.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

bleeping computerNews

Mar 9, 2026

ShinyHunters claims ongoing Salesforce Aura data theft attacks

A named data-theft tool referenced as having been used in the SnowFlake data theft attacks; mentioned only for naming similarity to the ShinyHunters tool.

mitiga blogNews

Jun 23, 2025

Tactical Guide to Threat Hunting in Snowflake Environments

An attack tool reportedly used in a Snowflake-focused credential-abuse campaign for data theft and extortion; specific capabilities are not described in the source.

picus security blogNews

Jun 7, 2024

7 June: Top Threat Actors, Malware, Vulnerabilities and Exploits

Malware used to steal credentials, which were then used to access cloud accounts and exfiltrate sensitive data from organizations such as Ticketmaster and Advance Auto Parts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

rapeflake