Brief #55: Snowflake Breach, AI-Powered Malware, CISO AI Pressures, Cybersecurity Talent Shortage

Happy week 23!

In this issue, I'm covering the Snowflake data breach potentially being one of the largest ever, the destructive malware taking down over 600,000 SOHO routers, the growing pressures CISOs face from AI and GenAI, and the need for more cybersecurity workers in the US.

---

Snowflake Customer Data Breach Potentially One of the Largest Ever

Matt Burgess from Wired reports that the data breach targeting customers of cloud storage company Snowflake may become one of the biggest ever. Cybercriminals have claimed to be selling stolen data from Ticketmaster, Santander, Advance Auto Parts, and LendingTree, allegedly taken from Snowflake accounts. The attack involved using infostealer malware to obtain login credentials and target accounts with single-factor authentication. The full scope and scale of the breach remains uncertain.

---

Destructive Malware Takes Over 600,000 SOHO Routers Offline

Lumen Technologies' Black Lotus Labs identified a destructive event where over 600,000 SOHO routers from a single ISP were taken offline over a 72-hour period in October. The infected devices were rendered permanently inoperable, requiring hardware replacement. The primary payload responsible was "Chalubo," a commodity remote access trojan (RAT). Chalubo has payloads for major SOHO/IoT kernels, can perform DDoS attacks, and execute Lua scripts. The malware was highly active in November 2023 and early 2024, with over 330,000 unique IPs communicating with C2 nodes in October alone. Lumen assesses with high confidence this was a deliberate destructive attack, likely using commodity malware to obfuscate attribution.

---

Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware

eSentire reports that fake browser updates are being used to deliver RAT and information stealer malware such as BitRAT and Lumma Stealer. The attack starts with a malicious website redirecting users to a fake browser update page hosting a ZIP archive containing malicious JavaScript that downloads additional payloads. ReliaQuest also discovered a ClearFake campaign variant that tricks users into manually executing malicious PowerShell code disguised as a browser update.