Stolen credentials used to breach at least 165 Snowflake customers. UK and Canada to investigate 23andMe data breach.

Announcement

Live podcast event with Zscaler.

Join Dave Bittner and Deepen Desai, Chief Security Officer of Zscaler, on Thursday, June 20th at 2pm ET for an exclusive deep dive into the critical topics of initial compromise risks, primarily focusing on threats posed by VPN vulnerabilities and sophisticated phishing attacks. In this discussion, we will share insights from recent research and reports by Zscaler ThreatLabz group, providing a detailed analysis of the most pressing security challenges organizations face today. Register now to secure your spot.

2024 N2K CyberWire Audience Survey.

We're always looking for ways to improve the N2K CyberWire network to give you an intelligence-driven news experience. Please take a few minutes to tell us about your network experience and share your feedback by completing our 2024 Audience Survey, and you will have a chance to win a $100 Amazon gift card. Take the survey.

Summary

By the CyberWire staff

At a glance.

Stolen credentials used to breach at least 165 Snowflake customers.
UK and Canada to investigate 23andMe data breach.
Arm patches actively exploited vulnerability.
Proof-of-concept exploit released for critical Veeam flaw.

Stolen credentials used to breach at least 165 Snowflake customers.

QuoteWizard, a subsidiary of financial services firm LendingTree, has confirmed that it sustained a data breach after threat actors compromised the company's Snowflake cloud storage account. A LendingTree spokesperson told the Record, "As of this time, it does not appear that consumer financial account information was impacted, nor information of the parent entity, Lending Tree. Given that this is an ongoing investigation we are not able to comment further."

Snowflake warned last week that customers using single-factor authentication were being targeted by a threat actor using stolen credentials. Mandiant, which Snowflake hired to investigate the campaign, stated in a blog post yesterday that the financially motivated threat actor UNC5537 "is systematically compromising Snowflake customer instances using stolen customer credentials, advertising victim data for sale on cybercrime forums, and attempting to extort many of the victims." Mandiant has identified at least 165 victims of the campaign.

The company added, "Mandiant's investigation has not found any evidence to suggest that unauthorized access to Snowflake customer accounts stemmed from a breach of Snowflake's enterprise environment. Instead, every incident Mandiant responded to associated with this campaign was traced back to compromised customer credentials." These credentials were stolen via "infostealer malware campaigns that infected non-Snowflake owned systems."

Join Cobalt’s Webinar on June 18 at 10:00AM PT: The Rise of AI and its impact on the Attack Surface

Join Cobalt security experts Caroline Wong, Chief Strategy Officer, and Anne Neilsen, Senior Director of Product Marketing from Cobalt, as they explore Cobalt 2024 State of Pentesting Report and reveal how top security teams are juggling the implications of accelerated AI adoption, the increased use of open source software, growing shifts to cloud technology, and an exploding attack surface, all amidst resource limitations within a tight talent pool of security practitioners. Here is what you will learn:

How organizations like yours are identifying and securing AI usage and AI-related threats amidst the rapid adoption of AI tools.
How a continued lack of cybersecurity resources impacts organizations and can lead to a backlog of unaddressed vulnerabilities - and increased security risk.
How the power of modern pentesting and an offensive security posture can help address these challenges.

UK and Canada to investigate 23andMe data breach.

Data privacy watchdogs in the UK and Canada will investigate a data breach sustained by genetic testing company 23andMe in October 2023, the BBC reports. Canada's Privacy Commissioner Philippe Dufresne stated that the joint investigation will examine:

"the scope of information that was exposed by the breach and potential harms to affected individuals;
"whether 23andMe had adequate safeguards to protect the highly sensitive information within its control; and
"whether the company provided adequate notification about the breach to the two regulators and affected individuals as required under Canadian and UK privacy and data protection laws."

23andMe disclosed in December that hackers compromised 14,000 customer accounts via password spraying, which gave them access to data belonging to 5.5 million people who had opted into 23andMe's DNA Relatives feature.

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

Arm patches actively exploited vulnerability.

Arm has issued an advisory warning of an actively exploited vulnerability (CVE-2024-4610) affecting Bifrost and Valhall GPU kernel drivers, BleepingComputer reports. The use-after-free vulnerability affects drivers from version r34p0 to version r40p0, and was fixed on June 7th with version r41p0. The flaw can allow "a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory."

Proof-of-concept exploit released for critical Veeam flaw.

A proof-of-concept exploit has been released for a critical authentication bypass flaw (CVE-2024-29849) affecting Veeam Backup Enterprise Manager, SecurityAffairs reports. The vulnerability, which was patched last month, "allows unauthenticated users to log in as any user to enterprise manager web interface." Users are urged to update to version 12.1.2.172 as soon as possible.

Save 25% off of N2K practice tests, training courses, and practice labs.

N2K offers affordable exam prep training for top certifications from AWS, CompTIA, ISC2, Microsoft, Cisco, and many others. Get access to simulated exams, custom quizzes, e-flashcards, and more. Explore N2K’s expansive learning library of premium practice tests, training courses, and practice labs to help supplement your studies and accelerate your career journey. Save 25% with promo code "JUMP25" and get started today.

Notes.

Today's issue includes events affecting Canada, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Christie's confirms RansomHub stole data on 45K clients (The Register) A far cry from the half-million claim that crims originally boasted

Hackers steal “significant volume” of data from hundreds of Snowflake customers (Ars Technica) Given shortcomings of Snowflake and its customers, there's plenty of blame to go around.

Cylance confirms data breach linked to 'third-party' platform (BleepingComputer) Cybersecurity company Cylance confirmed the legitimacy of data being sold on a hacking forum, stating that it is old data stolen from a "third-party platform."

Security Patches, Mitigations, and Software Updates

Exploit for critical Veeam auth bypass available, patch now (BleepingComputer) A proof-of-concept (PoC) exploit for a Veeam Backup Enterprise Manager authentication bypass flaw tracked as CVE-2024-29849 is now publicly available, making it urgent that admins apply the latest security updates.

Expert released PoC exploit code for Veeam Backup Enterprise Manager flaw CVE-2024-29849. Patch it now! (Security Affairs) A proof-of-concept (PoC) exploit code for a Veeam Backup Enterprise Manager authentication bypass flaw CVE-2024-29849 is publicly available.

Products, Services, and Solutions

DataBee™, from Comcast Technology Solutions, Launches New Innovations for Enhanced Threat Monitoring and Zero Trust Implementation (ShareWise) DataBee™, from Comcast Technology Solutions (CTS), today announced new capabilities in its DataBee Hive™ security, risk and compliance data fabric platform. DataBee EntityViews™, powered by a

Legislation, Policy, and Regulation

As markup nears, knives come out for comprehensive data privacy legislation (The Record) A coalition representing Fortune 500 companies wants the American Privacy Rights Act to override all existing state laws governing privacy.

FCC Advances BGP Security Rules for Broadband Providers (BankInfoSecurity) The U.S. Federal Communications Commission unanimously approved a notice of proposed rulemaking that would require major U.S. internet providers to establish and

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jun 24 - 25, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing an ITP. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. All materials will be provided to the student in electronic format (Via Download) before the training. Our student satisfaction levels are in the exceptional range. Over 1000+ individuals have attended this training course and received ITP Manager Certificates. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

Events

AWS re: Inforce (Philadelphia, Pennsylvania, USA, Jun 10 - 12, 2024) AWS re: Inforce is a conference that addresses AWS security and confidentiality for customers. The conference covers: Proactive security: Considerations and approaches; How AWS secures data, even from trusted operators and services; Identity and access management; Security mindfulness; Cryptography from the future: Research & innovation to protect customer data; Compliance and governance; Data protection and privacy; and Security operations.

Cyber Civil Defense Summit (Washington DC, Jun 13, 2024) The Cyber Civil Defense Summit brings together a community of cyber defenders, academics, and policymakers with the shared mission of protecting our most vulnerable public infrastructure against cybersecurity threats. This in-person event hosts exclusive keynotes and panels with government and industry leaders in cybersecurity, creating an intimate space for cross-sector conversations between academics, volunteers, and policymakers on how we can work together to protect vulnerable community organizations like hospitals, cities, school districts, and nonprofits.

SANS Rocky Mountain Summer 2024 (Denver (and virtual), Colorado, USA, Jun 17 - 22, 2024) At SANS Rocky Mountain Summer 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

ISA OT Cybersecurity Summit (London, England, UK, Jun 18 - 19, 2024) Strategic OT Cybersafety | Intelligent Innovation for a Secure World The future of intelligence evolution and IoT cybersecurity relies on a strategic approach that integrates supply chain sustainability and security. By leveraging intelligent technologies and prioritizing standards and conformance, we can create a more resilient and secure future for all.

Initial Compromise Insights: VPN and Phishing Attacks Exposed (Virtual, Jun 20, 2024) Join us for an exclusive deep dive into initial compromise risks, focusing on threats posed by VPN vulnerabilities and sophisticated phishing attacks, and share insights from recent research and reports by Zscaler ThreatLabz group. Register now.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 06.11.24