COMING SOONIntermediate
Frozen Assets: The Snowflake Tenant Heist
A retailer's Snowflake tenant is accessed with a contractor credential lifted from an infostealer log. With no MFA and no network policy to stop it, the actor logs in from VPN-exit IPs, recons with anomalous tooling, and bulk-exfiltrates an entire customer table. Work the Snowflake audit trail to reconstruct the theft.
1h
6 tasks
50 points
FreeLaunches tomorrow
Jul 3, 2026
Create your free accountFriday, July 3, 2026 at 9:00 AM
Be ready the moment it drops — free forever.
Training Tools
CloudSIEM
What you'll investigate
6 objectives unlock when this operation goes live.
1Spot the foothold
2Trace the first exit node
3Name the tooling tell
4Find the staging step
5Recover the exfiltrated table
6Classify the exfiltration
Be first when it launches
Create your free account now. The moment this operation goes live on Jul 3, 2026, you can jump straight in — and you'll have the rest of the catalog to train on meanwhile.
Get Started FreeNo credit card required — free forever