Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for Lateral Movement, Command and Control, or Exfiltration. Data exfiltrated from databases may also be used to extort victims or may be sold for profit.1
- Google Cloud Threat Intelligence UNC5537 Snowflake 2024
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g1041 | Sea Turtle | — |
| grp_g0037 | FIN6 | — |
| grp_g1057 | ShinyHunters | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0010 | Turla | Russia |
| grp_g0034 | Sandworm Team | Russia |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。