Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for Lateral Movement, Command and Control, or Exfiltration. Data exfiltrated from databases may also be used to extort victims or may be sold for profit.1
- Google Cloud Threat Intelligence UNC5537 Snowflake 2024
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1041 | Sea Turtle | — |
| grp_g0037 | FIN6 | — |
| grp_g1057 | ShinyHunters | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0010 | Turla | Russia |
| grp_g0034 | Sandworm Team | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.