IronNet Shares Critical Insights on the Snowflake Data Breach and the Role of Proactive Threat Intelligence

News provided by

Jun 14, 2024, 16:01 ET

HALETHORPE, Md., June 14, 2024 /PRNewswire/ -- IronNet, an innovative leader Transforming Cybersecurity Through Collective Defense^SM, today released insights into the recent Snowflake data breach, emphasizing the importance of proactive threat intelligence to prevent similar attacks.

Overview of the Snowflake Data Breach

IronNet’s IronRadar and Collective Defense detect and prevent threat like the infostealer malware used in the recent Snowflake Breach.

Mandiant reported a significant data breach affecting hundreds of Snowflake cloud storage customers, involving at least 165 organizations. The breach, caused by the financially motivated threat actor UNC5537 using stolen credentials from infostealer malware, highlighted a lack of proper security controls on Snowflake instances.

The incident underscores the critical importance of leveraging proactive threat intelligence to detect novel and evolving cyber threats before they can exploit vulnerabilities like missing Multi-Factor Authentication.

IronRadar: Proactive Defense Against Infostealers

Infostealers are malware designed to steal sensitive information like login credentials and financial data. According to Mandiant's analysis, infostealer activity related to this breach dates back to 2020, with attackers bypassing traditional defenses and transmitting stolen data to Command and Control (C2) servers.

IronRadar is designed to proactively detect and neutralize infostealer threats by identifying and monitoring C2 servers. Currently, IronRadar tracks 19 information stealer frameworks, and since the beginning of this year, over 700 infostealer indicators have been distributed to our customers across the Collective Defense community. This proactive approach ensures that threats are identified and mitigated before they can cause harm.

IronNet's Proactive Threat Intel Approach

When asked how IronNet would detect and respond to the Snowflake data breach, Blake Cahen, IronNet's Director of Cybersecurity Operations, explained, "In today's rapidly evolving cyber landscape, proactive threat intelligence is critical. We protect organizations from significant breaches like the recent Snowflake incident by identifying malicious C2 servers and other assets bad actors are preparing to use in an attack."

To prevent breaches, IronNet employs several key strategies:

Proactive Threat Intelligence: Providing intelligence of adversary C2 to customers' cybersecurity ecosystems to catch and mitigate malicious communications.
Network Anomaly Detection: Identifying anomalies at all stages of the C2 cycle, including suspicious file downloads, external communications, and data exfiltration.
Emerging Threat Research: Detecting network activity based on the latest research on malware tactics and procedures.
Collective Defense Correlation: Correlating alerts across the Collective Defense community to anonymously inform other customers of detected threats.

Attackers are always a step ahead. They know what technology and detections are commercially available and focus their efforts on evading them. Through our Collective Defense community, IronNet is enabling customers to bridge that gap. The bigger we grow, the more power we have. An attack against one is an attack against all.

About IronNet

IronNet is dedicated to delivering powerful Collective Defense to protect companies, sectors, and nations worldwide. By uniting advanced technology with a team of cybersecurity experts, IronNet is committed to providing peace of mind in the digital world.

For more information, visit ironnet.com or follow us on LinkedIn.

SOURCE IronNet