Threat intelligence / Technique

Databases

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)

18 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from Encrypt Sensitive Information

Mitigation

mitigates

from Software Configuration

Mitigation

mitigates

from User Account Management

Mitigation

mitigates

from User Training

Mitigation

subtechnique-of

to Data from Information Repositories

Technique

uses

from Anthropic AI-orchestrated Campaign

Campaign

uses

from APT41 DUST

Campaign

uses

from FIN6

Group

uses

Malware

uses

from Leviathan Australian Intrusions

Campaign

uses

from MgBot

Malware

uses

from P.A.S. Webshell

Malware

uses

from Sandworm Team

Group

uses

from Sea Turtle

Group

uses

from ShinyHunters

Group

uses

from TeamPCP Cloud Stealer

Malware

uses

from Turla

Group

2 external

References

mitre-attack

T1213.006

Google Cloud Threat Intelligence UNC5537 Snowflake 2024

https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion