Two Arrests, and No Names Here Yet

In October 2024 a man was arrested in Canada at the request of United States authorities in connection with the campaign against Snowflake tenants. A second person was reported detained in Turkey.

Both have been widely named in coverage. Neither is named here, and this file exists partly to say why.

This desk names individuals after conviction, not after arrest. The rule was set at 25-0724 and restated at 25-1205 and 25-0222 — most recently over a ransomware leader identified by researchers, which is the case that tests whether it is a rule or a preference.

An arrest is an allegation. It means investigators believe they have a case, and it is a fact about a process rather than about a person’s conduct. Publication is not reversible and this corpus has no ability to correct a wrong identification once it propagates.

That it was not a state operation. The corpus has recorded state-linked telecom intrusions in the same period; this one is financially motivated, run by a small number of people, and reached 165 organisations with stolen passwords.

That asymmetry is the finding this desk keeps returning to. At 25-0724 the argument was that an unsophisticated technique which works is worse than a sophisticated one, because it is available to far more people. A campaign of this reach requiring no exploit and no zero-day is that argument at scale.

The infostealer logs that supplied the credentials remain in circulation, and the tenants that lacked a second factor were not fixed by an arrest. The corpus filed at 25-0218 that dismantling a brand destroys the cheapest component; the same is true of removing an operator.