UNC5537
Mandiant tracked the group that stole data from Snowflake customer environments and extorted victims as UNC5537; the group tried to sell the stolen data on forums. Google Cloud (Mandiant)
The person, group or organisation behind a cyberattack.
NIST defines a threat actor as an individual or group with the intent or capability to harm an organisation. Actors are distinguished by their goals: financial gain, espionage, sabotage or ideology. NIST CSRC
Security vendors track actors with their own naming systems (e.g. TA547, UNC5537); the same group may carry different names at different vendors. These tracking names are used instead of unverified identities. CISA
The actor acquires malware, domains and servers. MITRE ATT&CK
It attacks a specific audience with a specific method.
Recurring domains, code fragments and methods link activity to the actor. CISA
Mandiant tracked the group that stole data from Snowflake customer environments and extorted victims as UNC5537; the group tried to sell the stolen data on forums. Google Cloud (Mandiant)
Proofpoint tracked the group targeting German organisations with Rhadamanthys as TA547. Proofpoint
Zscaler documented the BlindEagle group targeting a government agency in Colombia with DCRat. Zscaler
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy