Loading story…
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander, and LendingTree, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers.
Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least 79.7% of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s SnowSight web interface, the SnowSQL CLI, DBeaver Ultimate, and a reconnaissance utility tracked as FROSTBITE to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than $2.5 million in ransom payments, while Moucka separately made about $495,000 selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Connor Riley Moucka pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and related conspiracy charges tied to the Snowflake-linked hacking and extortion campaign. The Justice Department announced the plea on August 5, 2026.
After agreeing to surrender for extradition, Moucka arrived in the Western District of Washington and made his first U.S. court appearance. The Justice Department-linked reporting dates that appearance to July 3, 2025.
Cameron John Wagenius, a former Army soldier tied by prosecutors to the same Snowflake-linked intrusions, pleaded guilty in a related case. The reference dates that plea to July 2025.
According to prosecutors, Moucka and co-conspirators used stolen login credentials to access cloud-hosted data and Snowflake customer accounts between February and October 2024. The campaign affected at least 165 organizations and led to theft of terabytes of sensitive data.
Mandiant said the earliest infostealer infection associated with a credential later used in the Snowflake customer compromise campaign dated to November 2020. It also reported that hundreds of Snowflake credentials had been exposed via infostealers since 2020.
Authorities arrested Connor Riley Moucka in Canada in late 2024 in connection with the cloud hacking and extortion campaign. One source places the arrest in October 2024, while another reports it in November 2024.
Mandiant reported that UNC5537 primarily relied on previously exposed Snowflake credentials stolen by infostealer malware, with at least 79.7% of accounts used in the campaign showing prior credential exposure. It also described attacker tradecraft including use of SnowSight, SnowSQL, FROSTBITE, and DBeaver Ultimate for access and reconnaissance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
20 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecio.com
Open sourcecio.com
Open sourcemalware.news
Open sourcetherecord.media
Open sourcedarkwebinformer.com
Open sourcejustice.gov
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A broad intrusion campaign compromised **Snowflake customer environments** including Ticketmaster, Santander and AT&T after attackers used credentials stolen by infostealer malware or bought on criminal forums, rather than exploiting a flaw in Snowflake itself. Reporting tied the activity to **ShinyHunters**, which advertised allegedly stolen data from Ticketmaster and Santander, while Mandiant said many affected accounts lacked **multifactor authentication** and that more than 100 customer environments were targeted. AT&T said the attackers accessed its Snowflake environment in April and stole call and text metadata for nearly **110 million** customers, including numbers contacted, interaction counts and aggregate call durations, but not message content. The campaign evolved from data theft into **extortion**, with victims receiving ransom demands and law enforcement pursuing suspects tied to the operation. Canadian authorities arrested a man from Kitchener, Ontario, in connection with the Snowflake hacking and extortion scheme, and reporting later indicated another suspected participant may have been a U.S. soldier. Government agencies including Australia’s Signals Directorate and U.S. investigators were drawn into the response, and AT&T said disclosure of its breach was temporarily delayed at the request of the FBI and DOJ because of national security and public safety concerns.
Jun 29, 2026
U.S. prosecutors indicted Swiss national Till Kottmann, also known as **"deletescape"** and **"tillie crimew,"** on charges including conspiracy, wire fraud, and aggravated identity theft for allegedly hacking dozens of companies and government entities, stealing confidential data and credentials, and publishing material from more than 100 victims online. The indictment says the activity began in 2019 and included intrusions into source code repositories and other systems at major organizations including **Microsoft, Intel, Nintendo, Nissan, Daimler, Disney**, a Washington state agency, and a U.S. government contractor; the FBI also seized the **`git.rip`** domain that investigators said was used to leak stolen data. The case also linked Kottmann to the high-profile **Verkada** intrusion, in which exposed super-admin credentials were allegedly used to access more than **150,000 surveillance cameras** at prisons, hospitals, warehouses, schools, and Tesla facilities. U.S. authorities, working with Swiss counterparts, said search warrants were executed in Lucerne and devices were seized, while media reports noted Kottmann had described the attacks as anti-capitalist hacktivism and "easy" acts of anarchism; prosecutors instead characterized the campaign as criminal theft, fraud, and identity abuse affecting both private companies and public-sector targets.
Jun 29, 2026
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias **"Loot"** to send more than 60 extortion emails between December 2023 and January 2024 demanding **$2.5 million in cryptocurrency**. The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the **"Loot"** persona.
Aug 19, 2026