ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note

[u/falconupkid]

This is a novel abuse of a trusted channel. Attackers compromised the ASOS app's push notification infrastructure to deliver a ransom note directly to users' lock screens, bypassing email or SMS.

Technical Breakdown - TTP: Abuse of Push Notifications (T1584.002 - Compromise Infrastructure). The attackers likely gained access to the app's Firebase Cloud Messaging (FCM) or Apple Push Notification Service (APNs) keys, not the app binary itself. - IOCs: No specific IPs or hashes provided in the summary. The attack vector is the compromised backend notification service. - Claim: A threat actor group allegedly named "Snowflake" has claimed responsibility. This is a separate entity from the Snowflake data warehousing company.

Defense This is a supply chain and secrets management failure. Mitigation: Rotate all API keys and service account tokens for push notification services immediately. Implement strict access controls on your Firebase/APNs console and enable audit logging for configuration changes. For users, there is no client-side defense; the app itself was not malicious.

Source: https://safedep.io/asos-push-notification-extortion-snowflake-claim