UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Essential information
- Published
- 12/06/2024 10:34
- Modified
- 12/06/2024 11:03
- Tags
- 2024-06-12 data theft extortion snowflake unc5537
- Related entities
- 48 observables, 1 intrusion sets (apt), 14 techniques (mitre), 7 malware
Description
An extensive cybercriminal campaign led by a threat actor codenamed UNC5537 has compromised numerous Snowflake customer database instances with the intent of data theft and extortion. The threat actor exploited stolen customer credentials, predominantly obtained through infostealer malware infections dating back to 2020, to gain unauthorized access to Snowflake instances lacking multi-factor authentication and network-level restrictions. UNC5537 systematically exfiltrated valuable data and subsequently attempted to extort victims or advertise the stolen data on cybercrime forums for sale. This campaign highlights the consequences of credential theft, inadequate authentication measures, and the need for enhanced security practices.