Loading threat actor…
UNC5537 is a financially motivated cybercrime cluster associated with large-scale data theft and extortion operations against Snowflake customer environments in 2024. The actor is widely linked in reporting to the broader ShinyHunters and Scattered Spider ecosystem, and some reporting also describes overlap with LAPSUS$-adjacent operators, but the core high-confidence activity attributed to UNC5537 is the Snowflake intrusion and extortion campaign. The group compromised at least 165 organizations by using valid credentials previously stolen by infostealer malware from customer employees and contractors rather than exploiting a vulnerability in Snowflake itself. Intrusions were consistently enabled by weak identity controls on victim accounts, especially absent multi-factor authentication, long-lived unrotated credentials, and lack of network allow-list restrictions. Investigations found many of the credentials used by the actor had prior exposure dating back years. UNC5537 focused on accessing cloud-hosted data stores, conducting reconnaissance within Snowflake environments, running queries across victim instances, and exfiltrating large volumes of sensitive records for monetization. Observed tradecraft included use of Snowflake’s web interface, the SnowSQL command-line client, DBeaver Ultimate, and an attacker-named utility tracked as FROSTBITE for SQL-based reconnaissance and bulk data access. The actor’s operations relied more on credential abuse and post-access data operations than on novel exploitation. After obtaining data, UNC5537 extorted victim organizations and also sold stolen information on criminal forums. Publicly identified victims span telecommunications, financial services, retail, insurance, industrial, and technology-related organizations. Reporting also notes harassment and re-extortion behavior in at least some cases. The campaign illustrates a cloud-focused, identity-driven intrusion model in which infostealer-derived credentials, weak authentication posture, and commodity tooling were sufficient to enable high-impact enterprise breaches at scale.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercrime group tied to a campaign that used stolen login credentials to access organizations' Snowflake data storage accounts, steal massive amounts of sensitive data, extort victims, and sell stolen data on hacking forums.
A financially motivated intrusion cluster tied to the 2024 Snowflake customer-account breaches, using credentials previously harvested by infostealer malware to access victim environments, steal data, and extort victims.
Used infostealer-harvested credentials to access Snowflake customer environments and conduct large-scale data theft and extortion, relying on stolen usernames, passwords, and absent MFA rather than exploiting a software vulnerability.
Named activity cluster mentioned as part of the cluster evolution associated with the ShinyHunters profile, but no specific operational details are provided in the content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.