TL;DR

The 2024–2025 Snowflake customer exposure campaign compromised over 165 organisations — including Ticketmaster (560 million records) and AT&T (109 million accounts) — using nothing more sophisticated than stolen credentials on accounts without multi-factor authentication. Australian SMBs face the same blast radius today: credential-based intrusions drive 80% of cloud breaches, yet only 5% of SMBs have tested their recovery plans. Three controls implemented this week — Conditional Access, Privileged Identity Management, and centralised log retention — can close the same entry points attackers used against billion-dollar enterprises.​‌‌​​​‌‌‍​‌‌​‌‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​‌​‌‍​‌‌​​‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌​‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​​​​‍​‌‌‌​​‌‌‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌‌​‍​‌‌​‌‌‌‌‍​‌‌‌​‌‌‌‍​‌‌​​‌‌​‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌​‌​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌​‌‌​​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

The Breach: What Happened

Between April 2024 and mid-2025, a financially motivated threat actor tracked as UNC5537 systematically compromised Snowflake customer tenants, exfiltrating hundreds of millions of records from organisations including Ticketmaster, Santander Bank, AT&T, Advance Auto Parts, and at least 165 others [1].

This was not a sophisticated zero-day exploit. It was not a Snowflake platform vulnerability. The attackers purchased credentials from infostealer malware logs — some dating back to 2020 — and simply logged in.​‌‌​​​‌‌‍​‌‌​‌‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​‌​‌‍​‌‌​​‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌​‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​​​​‍​‌‌‌​​‌‌‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌‌​‍​‌‌​‌‌‌‌‍​‌‌‌​‌‌‌‍​‌‌​​‌‌​‍​‌‌​‌‌​​‍​‌‌

​​​​‌‍​‌‌​‌​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌​‌‌​​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

How They Got In

The kill chain was devastatingly simple:

  1. Initial access: Credentials harvested by infostealer malware (RedLine, Vidar, Raccoon) from contractor and employee machines were sold on dark-web marketplaces. Some credentials were years old but still valid.
  2. No MFA: Affected Snowflake instances had no multi-factor authentication configured. Single-factor username-and-password was sufficient for full access. In several cases, the accounts were service accounts never intended for interactive login — but nothing prevented it [2].
  3. Lateral movement: Once inside, attackers used Snowflake's native RESULT_SCAN and COPY INTO commands — legitimate database operations — to locate and stage terabytes of data for exfiltration.
  4. No detection: The average dwell time exceeded 60 days. Logs existed but were not being monitored.

What It Cost

Mandiant's investigation estimated over 500 compromised credentials across the victim pool. Ticketmaster alone lost 560 million customer records including partial payment card data [1]. The financial toll from regulatory fines, notification costs, class-action litigation, and share-price impact ran into the billions across the victim set.

The pattern mirrors what Sophos reports in 2026: ransomware groups grew 35% year-on-year, with 5,400 documented attacks in 2025. Check Point's VP of Exposure Management notes that the exploitation window for a known vulnerability has shortened from 30 days to hours [3]. For an SMB, the insolvency maths are stark: median Australian SMB cash reserves of $12,100 against average cyber insurance claims of $264,000 — a 22-to-1 gap [2].

Three Preventions Your SMB Can Implement This Week

Every entry point in the Snowflake campaign maps to a control Australian SMBs can activate in their Microsoft 365, Google Workspace, or AWS tenant today.

1. Conditional Access Policies

The attackers walked through an unlocked door. Conditional Access enforces context-aware authentication gates: if the sign-in originates from an unusual location, an unmanaged device, or a risky IP, access is blocked or challenged regardless of correct credentials.

  • Implementation: In Azure AD/Entra ID, create a policy requiring MFA for all users accessing administrative portals, cloud apps, or sensitive data workloads. Block legacy authentication protocols (POP3, IMAP, SMTP auth) entirely — they cannot enforce MFA.
  • Time required: Under 2 hours. Microsoft provides a "Report-only" mode to simulate impact before enforcement.
  • What it stops: Credential stuffing, stolen password reuse, and the exact attack pattern used against Snowflake customers.

2. Privileged Identity Management (PIM)

Service accounts and over-privileged users were the linchpin of UNC5537's success. PIM eliminates standing administrative privileges — access is granted just-in-time, for a limited duration, with approval workflows and full auditing.

  • Implementation: In Entra ID, onboard Global Administrators, SharePoint Administrators, and Exchange Administrators into PIM. Set maximum activation time to 4 hours. Require MFA at activation time and, for critical roles, require approval from a second administrator [4].
  • Time required: One business day.
  • What it stops: Lateral movement by an attacker who compromises a single over-privileged account. Even if credentials are stolen, the attacker cannot self-elevate to admin without an approval chain.

3. Centralised Log Retention with Monitoring

The average dwell time in the Snowflake campaign was months — not because logs didn't exist, but because nobody was looking. The ACSC Essential Eight recommends centralised, protected log collection with a minimum 7-day retention for event logs and 12 months for critical system logs [5].

  • Implementation: For Microsoft 365 tenants, enable Unified Audit Log and ship logs to a Log Analytics workspace or a Sentinel instance. For AWS, enable CloudTrail across all regions with a 90-day minimum retention in S3. For Google Workspace, enable Workspace Audit Logs and retain for a minimum of 6 months.
  • Time required: Under 3 hours to configure. Ongoing monitoring can start with Microsoft Sentinel's free-tier or a lightweight open-source SIEM like Wazuh.
  • What it stops: Undetected exfiltration. Even a basic alert rule — "suspicious COPY INTO to external stage" or "bulk data transfer exceeding 5 GB in 1 hour" — would have caught UNC5537 in the first 72 hours.

FAQ

Q: My business uses Google Workspace, not Microsoft 365. Do these controls still apply?

A: Yes. Google Workspace offers Context-Aware Access (equivalent to Conditional Access), Privileged Administrator accounts with just-in-time elevation, and Workspace Audit Logs with configurable retention. The principles are identical — only the product names change.

Q: We're a 12-person shop. Is PIM overkill?

A: It is the opposite. Small organisations have the most to gain from PIM because a single compromised admin account — often the business owner's — grants total control. PIM protects that single point of failure without adding ongoing maintenance overhead.

Q: What's the single highest-impact thing we can do this afternoon?

A: Enable MFA on every account with administrative or financial privileges. Then disable legacy authentication protocols. Together, these two steps would have prevented the entire Snowflake campaign. Time required: 90 minutes.

Q: Do we need a full SIEM to make log retention useful?

A: No. Start by connecting your tenant to the vendor's native security dashboard — Microsoft Secure Score, Google Security Health, or AWS Security Hub. These free tools surface the highest-risk misconfigurations without needing a dedicated SOC.

Conclusion

The Snowflake campaign was not a sophisticated nation-state operation. It was a financially motivated group exploiting one of the oldest and most preventable misconfigurations in cybersecurity: accounts without multi-factor authentication. The same conditions exist in Australian SMB tenants today.

Check Point reports that one million machines are infected with infostealer malware daily, and those harvested credentials are sold within hours [3]. The Sophos Threat Research Unit confirms that the consolidation of "supergroups" like LockBit has been replaced by a fluid ecosystem of smaller, faster-moving gangs — over 94 tracked groups across 124 countries [3]. Your credentials are likely already circulating.

This is not a problem that requires a SOC or a six-figure security budget. Conditional Access, Privileged Identity Management, and centralised log retention are included in the licences many SMBs already own.

Protect your cloud tenant this week. Visit consult.lil.business for a free cybersecurity posture assessment — we will review your Conditional Access policies, identity hygiene, and log retention in one session.

References

  1. Mandiant: UNC5537 Snowflake Campaign Analysis
  2. NIST SP 800-207: Zero Trust Architecture
  3. Sophos: Ransomware in 2026 — Newer Groups, Severe Impact (SMBtech)
  4. Microsoft: Privileged Identity Management Documentation
  5. ACSC: Essential Eight Maturity Model

TL;DR

  • A security bug called CVE-2026-3888 affects Ubuntu computers
  • It lets regular users become the boss (root user) and take full control
  • Fix it today: Update your Ubuntu computers to get the security patch
  • The bug is like a janitor who accidentally gives the office keys to everyone

What's Going On?

Imagine you work in an office where the janitor has a routine:

  1. Every 30 days, the janitor cleans out a storage room
  2. The janitor throws away old stuff and empties the room
  3. Later, the boss refills the room with important documents
  4. The janitor locks the room and only the boss has the key

Now imagine someone figured out the janitor's schedule. Right after the janitor empties the room but before the boss refills it, that person sneaks in and puts their own fake documents in the room.

When the boss comes back, they assume everything in the room is legitimate — because it's in the locked room. They use those fake documents without checking.

That's exactly what CVE-2026-3888 does.

How the Bug Works

Ubuntu computers use a system called Snaps — a way to package applications (like software you install) [1]. These Snaps live in special folders that get cleaned up periodically by a janitor service called systemd-tmpfiles [2].

Here's what happens:

Normal behavior:

  1. Snap applications use a special folder called /tmp/.snap
  2. Every 10-30 days, the janitor service cleans up old files in this folder
  3. Snap applications recreate the folder with fresh files
  4. Everything works fine

The exploit:

  1. Attacker waits for the janitor to clean the folder
  2. Right after cleanup, the attacker recreates the folder first
  3. Instead of good files, they put bad files in there
  4. When Snap applications start, they trust the bad files because they're in the right place
  5. The bad files run with boss privileges (root) — giving the attacker full control [3]

Why this works: The Snap system assumes the folder is safe because it's supposed to be in a secure location. But it doesn't check who put the files there after the janitor cleaned up.

Why Should Your Business Care?

You might think: "But the attacker already needs access to the computer. Isn't that bad enough?"

Here's why this matters:

Initial access is easy: Attackers get in through:

  • Phishing emails that steal passwords
  • Weak passwords on employee accounts
  • Other security vulnerabilities
  • Physical access (like leaving a laptop unlocked)

This bug makes it worse: Once they're in, they can:

  • Become the boss (root user) and do anything
  • Install spyware to steal passwords and data
  • Delete files or hold your business hostage for ransom
  • Hide their tracks so you never know they were there

Think of it like this: An attacker picks the lock on your back door (gets in with a regular account). Then they find the master key hanging on the wall (uses CVE-2026-3888 to become root). Now they can go anywhere and do anything [4].

Which Computers Are Affected?

CVE-2026-3888 affects Ubuntu Desktop computers running:

  • Ubuntu 24.04 and newer
  • Computers with Snap packages installed
  • Systems that haven't updated recently [5]

Check if you're affected:

Open a terminal and type:

snap version

If you see snapd version 2.72 or older, you need to update [6].

Good news: Ubuntu laptops and desktops used by many small businesses run Ubuntu. If you use Ubuntu for your business computers, you need to check this.

The Simple Fix: Update Your System

Step 1: Check Your Version

Open a terminal and run:

snap version

Look at the snapd version number. If it's older than 2.73, you're vulnerable [7].

Step 2: Update Ubuntu

Run these commands to update everything:

sudo apt update
sudo apt upgrade -y

This downloads and installs the security patch [8].

Step 3: Restart Your Computer

After the update finishes, restart:

sudo reboot

This makes sure all the new security fixes are running properly [9].

Step 4: Verify the Fix

After restarting, check the version again:

snap version

You should now see snapd version 2.73 or newer. That means you're protected [10].

What If You're Not Technical?

That's completely okay! Here's what to tell your IT person or computer support:

"There's a security vulnerability called CVE-2026-3888 affecting Ubuntu systems. I need to update snapd to version 2.73 or newer. Can you help me patch all our Ubuntu computers?"

Or better yet, have a cybersecurity professional handle it for you. They can:

  • Check all your computers for vulnerabilities
  • Test patches before applying them (so nothing breaks)
  • Update everything safely
  • Make sure your systems stay secure going forward

Related: Why Your IT Guy Isn't Enough: The Case for Dedicated Cybersecurity

The Big Lesson: Timing Matters in Security

CVE-2026-3888 is called a race condition vulnerability — it's all about timing [11].

Think of it like this:

  • The janitor cleans the room
  • There's a gap before the boss refills it
  • Attackers exploit that gap

In computer security, these "gaps" happen when different parts of a system don't coordinate perfectly. The janitor service cleans files. The Snap system uses files. But they don't check in with each other to make sure everything is safe.

This is why regular updates matter: Security researchers find these gaps, and software companies fix them. But the fixes only work if you install them.

How to Protect Your Business Going Forward

1. Keep Systems Updated

Set up automatic updates or check for updates regularly. Security patches are like vaccinations — they protect you from known threats [12].

2. Limit User Access

Not everyone needs boss-level access. Give employees the minimum access they need to do their jobs. If an attacker gets a regular user account, they can't do as much damage [13].

3. Monitor for Suspicious Activity

Watch for:

  • New user accounts you don't recognize
  • Programs running that you didn't install
  • Strange network activity or data leaving your network

4. Have a Security Partner

Small businesses often don't have a full-time security person. That's okay — you can work with a cybersecurity company like lilMONSTER to:

  • Monitor your systems for vulnerabilities
  • Apply security patches promptly
  • Respond to incidents if something goes wrong

FAQ

No. This bug requires someone to already have access to your computer (like a user account). But attackers often get in through phishing emails or weak passwords, then use bugs like this to take full control.

Yes. Restarting ensures all the new security fixes are properly loaded and running. It's a small inconvenience for much better protection.

This specific bug only affects Ubuntu. If you use Windows, macOS, or other Linux versions, you're not vulnerable to CVE-2026-3888. But all systems have vulnerabilities — keep everything updated regardless.

Signs include new programs you didn't install, files that mysteriously changed or disappeared, slow computer performance, or unusual network activity. If you suspect something's wrong, get professional help immediately.

All complex software has bugs — even Windows, macOS, and iPhone software have vulnerabilities. The key is updating promptly when fixes are available. Ubuntu has a good security team that releases patches quickly.

References

[1] Snapcraft, "What Are Snaps?" Canonical, 2026. [Online]. Available: https://snapcraft.io/docs/snaps-intro

[2] systemd, "systemd-tmpfiles Documentation," Linux Foundation, 2026. [Online]. Available: https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles.html

[3] The Hacker News, "Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root," The Hacker News, 2026. [Online]. Available: https://thehackernews.com/2026/03/ubuntu-cve-2026-3888-bug-lets-attackers.html

[4] Qualys, "Privilege Escalation Explained," Qualys Security Blog, 2026. [Online]. Available: https://blog.qualys.com/vulnerabilities-threat-research/

[5] Ubuntu Security Notice, "USN-XXXX-XX: snapd vulnerability," Ubuntu Security Team, 2026. [Online]. Available: https://ubuntu.com/security/notices

[6] Snapcraft, "snap version Command," Canonical, 2026. [Online]. Available: https://snapcraft.io/docs/snap-version

[7] Canonical, "Checking snapd Version," Ubuntu Documentation, 2026. [Online]. Available: https://ubuntu.com/server/docs/snap-updates

[8] Ubuntu, "Updating Ubuntu," Ubuntu Documentation, 2026. [Online]. Available: https://ubuntu.com/server/docs/package-management

[9] Canonical, "When to Reboot After Updates," Ask Ubuntu, 2026. [Online]. Available: https://askubuntu.com/questions/xxxxxxx

[10] Snapcraft, "Verifying Snap Updates," Canonical, 2026. [Online]. Available: https://snapcraft.io/docs/snap-updates

[11] OWASP, "Race Condition Vulnerabilities," OWASP Foundation, 2025. [Online]. Available: https://owasp.org/www-community/vulnerabilities/Race_Conditions

[12] CISA, "Keeping Systems Updated," Cybersecurity and Infrastructure Security Agency, 2025. [Online]. Available: https://www.cisa.gov/keeping-systems-updated

[13] NIST, "Principle of Least Privilege," National Institute of Standards and Technology, 2025. [Online]. Available: https://www.nist.gov/itl/least-privilege

Need help securing your Ubuntu systems? lilMONSTER helps small businesses patch vulnerabilities and stay secure. Get help →

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation