[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXgwwdzsQZ4lTBwSwpYW0jV8cH_cNxuTQAR5WrdTT6qY":3},{"article":4,"iocs":54,"watch_terms":64,"solutions":65,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":36},"afb903cb-34b8-4171-9e54-579188d6f2af","Canadian Man Pleads Guilty in Snowflake Extortions","canadian-man-pleads-guilty-in-snowflake-extortions-58eb3c","A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.","Connor Riley Moucka, a Canadian national identified as a significant cybercrime threat actor, has pleaded guilty to computer fraud and conspiracy charges. He admitted to hacking and extorting over 165 organizations by exploiting stolen credentials for Snowflake customer accounts that lacked multi-factor authentication. The scheme also involved stealing call and text history records of over 100 million AT&T customers, with the conspirators extorting victims for over $2.5 million.","Canadian man pleads guilty to hacking and extorting over 165 organizations via Snowflake.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F08\u002Fcanadian-man-pleads-guilty-in-snowflake-extortions\u002F",null,"2026-08-06T17:00:56+00:00","2026-08-06T18:00:07.921222+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Connor Riley Moucka","threat_actor",{"name":21,"type":22},"Snowflake","product",{"name":24,"type":25},"AT&T","vendor",{"name":27,"type":19},"Cameron Wagenius",{"name":29,"type":25},"TicketMaster",{"name":31,"type":25},"Lending Tree","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":12,"name":34,"slug":35},"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":32,"icon":12,"name":34,"slug":35},{"category":45},{"id":46,"icon":12,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":12,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61],{"type":56,"value":57,"context":58},"malware","Judische","Alias used by Connor Riley Moucka",{"type":56,"value":60,"context":58},"Waifu",{"type":56,"value":62,"context":63},"Kiberphant0m","Alias used by co-conspirator Cameron Wagenius",[24,29,31],{"controls":66,"vendors":151},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":97,"name":98,"problem":99,"products":100},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":126,"name":127,"problem":128,"products":129},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[130,135,143],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":131,"product_name":132,"url":133,"description":134},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":166},"mfa-absence-enabled-mass-snowflake-account-compromise","MFA Absence Enabled Mass Snowflake Account Compromise","Connor Moucka exploited a fundamental access control failure: Snowflake customer accounts without multi-factor authentication (MFA) were accessible using only stolen credentials, which are routinely available via infostealer malware and credential marketplaces. The absence of MFA transformed credential theft into a direct path to sensitive data across 165 organizations, including the records of over 100 million AT&T customers. This incident demonstrates that even a reputable cloud platform cannot protect customers who neglect basic authentication hygiene. The $2.5 million extortion outcome underscores that weak configurations in cloud environments carry real financial and reputational consequences, and that organizations remain accountable for their own security posture within shared-responsibility models.",[157,158,159,160,161,162,163,164,165],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","NIST SP 800-53 IA-2: Identification and Authentication (MFA)","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST CSF PR.AC-1: Identities and credentials are managed","GDPR Article 32: Security of Processing (appropriate technical measures)","ISO\u002FIEC 27001 A.9.4: System and Application Access Control","NIST SP 800-63B: Digital Identity Guidelines (Authenticator Assurance Level 2+)",{}]