UNC5537
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:15:50
Targeted industries: financial-services technology-and-telecommunications
Context
UNC5537 is a financially motivated threat actor targeting Snowflake customer databases. They use stolen credentials obtained from infostealer malware to access and exfiltrate large volumes of data. The compromised accounts lack multi-factor authentication, allowing UNC5537 to conduct data theft and extortion.
Reports & references
- research.checkpoint.com — 17Th June Threat Intelligence Report (report)
- cloud.google.com — Unc5537 Snowflake Data Theft Extortion (report)