UNC5537Threat actor
UNC5537 is a financially motivated threat actor targeting Snowflake customer databases. They use stolen credentials obtained from infostealer malware to access and exfiltrate large volumes of data. The compromised accounts lack multi-factor authentication, allowing UNC5537 to conduct data theft and extortion.From MISP Galaxy
Last reported 12 days ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 15 · each with the sentence it comes from- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1078Valid Accounts
“Stage 3: Internal system access (T1078)”
- T1078.004Cloud Accounts
“Stage 5: Potential downstream exploitation (T1078.004)”
- T1087Account Discovery
“T1087”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Introducing Sekoia Digital Risk: Track Identity-Led Breaches“The attackers, tracked as UNC5537, had simply bought credentials.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“The Snowflake intrusions themselves are tracked by Mandiant under the designation UNC5537, and the individuals eventually charged for them (Connor Riley Moucka and John Erin Binns) are not part of the historic ShinyHunters core responsible for the 2020 to 2023 breaches.”
-
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables“Threat actor UNC5537 used credentials obtained from infostealer malware to access Snowflake customer accounts that lacked MFA.”
Indicators in its reports
named in the reports above- context[.]aiin 1 report
- env[.]readin 1 report
- security[.]orgin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.