UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion

Introduction

Through the course of our incident response engagements and threat intelligence collections, Mandiant has identified a threat campaign targeting Snowflake customer database instances with the intent of data theft and extortion. Snowflake is a multi-cloud data warehousing platform used to store and analyze large amounts of structured and unstructured data. Mandiant tracks this cluster of activity as UNC5537, a financially motivated threat actor suspected to have stolen a significant volume of records from Snowflake customer environments. UNC5537 is systematically …

campaign cloud cloud data collections course customer data database data theft data warehousing extortion incident incident response intelligence intent introduction large mandiant multi-cloud platform response snowflake store targeting theft threat threat intelligence unc5537