UNC5537

A financially motivated cluster responsible for mass compromise of Snowflake customer tenants in 2024. It used credentials previously stolen by information stealers, especially where MFA was absent, to exfiltrate large datasets and extort victim organizations.