UNC5537

Linked to Canada by one source.

Reports: 18
Last reported: 16 June 2026
Known CVEs: 14
Origin: Canada

ID: unc5537
Sources: MISP ETDA Malpedia
Merge evidence: 2 alias matches

Reports per quarter

2022 Q2: 2 reports
2022 Q3: 2 reports
2022 Q4: 1 report
2023 Q1: no reports
2023 Q2: 1 report
2023 Q3: no reports
2023 Q4: 1 report
2024 Q1: no reports
2024 Q2: 3 reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: 1 report
2025 Q3: 1 report
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 6 reports

Dated reports, 2022 Q2 to 2026 Q2.

Techniques seen in the last two years

T1005 1 report
T1007 1 report
T1008 1 report
T1010 1 report
T1012 1 report
T1016 1 report
T1016.001 1 report
T1018 1 report
T1020 1 report
T1021 1 report

Show all 234 techniques Show fewer

T1021.001 1 report
T1021.002 1 report
T1021.004 1 report
T1021.005 1 report
T1021.006 1 report
T1027 1 report
T1033 1 report
T1037 1 report
T1037.001 1 report
T1039 1 report
T1040 1 report
T1041 1 report
T1046 1 report
T1047 1 report
T1049 1 report
T1053 1 report
T1053.003 1 report
T1053.005 1 report
T1055 1 report
T1055.001 1 report
T1055.002 1 report
T1055.003 1 report
T1055.004 1 report
T1055.009 1 report
T1055.012 1 report
T1056 1 report
T1056.001 1 report
T1057 1 report
T1059 1 report
T1059.001 1 report
T1059.002 1 report
T1059.003 1 report
T1059.004 1 report
T1059.005 1 report
T1059.006 1 report
T1059.007 1 report
T1059.009 1 report
T1059.010 1 report
T1059.011 1 report
T1068 1 report
T1069 1 report
T1069.001 1 report
T1069.002 1 report
T1069.003 1 report
T1070 1 report
T1070.004 1 report
T1071 1 report
T1071.001 1 report
T1071.004 1 report
T1072 1 report
T1074 1 report
T1074.001 1 report
T1074.002 1 report
T1078 1 report
T1078.004 1 report
T1082 1 report
T1083 1 report
T1087 1 report
T1087.001 1 report
T1087.002 1 report
T1087.004 1 report
T1090 1 report
T1090.001 1 report
T1090.003 1 report
T1091 1 report
T1095 1 report
T1098 1 report
T1098.001 1 report
T1098.003 1 report
T1098.004 1 report
T1098.005 1 report
T1098.006 1 report
T1098.007 1 report
T1102 1 report
T1102.002 1 report
T1104 1 report
T1105 1 report
T1113 1 report
T1114 1 report
T1114.001 1 report
T1114.002 1 report
T1114.003 1 report
T1115 1 report
T1119 1 report
T1120 1 report
T1123 1 report
T1124 1 report
T1125 1 report
T1129 1 report
T1132 1 report
T1132.001 1 report
T1133 1 report
T1134 1 report
T1134.001 1 report
T1135 1 report
T1136 1 report
T1136.001 1 report
T1136.002 1 report
T1137 1 report
T1137.006 1 report
T1140 1 report
T1189 1 report
T1190 1 report
T1195 1 report
T1195.002 1 report
T1199 1 report
T1200 1 report
T1201 1 report
T1203 1 report
T1204 1 report
T1204.001 1 report
T1204.002 1 report
T1210 1 report
T1213 1 report
T1213.001 1 report
T1213.002 1 report
T1213.003 1 report
T1217 1 report
T1219 1 report
T1482 1 report
T1484 1 report
T1484.001 1 report
T1485 1 report
T1486 1 report
T1489 1 report
T1490 1 report
T1491.002 1 report
T1496 1 report
T1497 1 report
T1497.001 1 report
T1505 1 report
T1505.003 1 report
T1505.004 1 report
T1518 1 report
T1518.001 1 report
T1529 1 report
T1530 1 report
T1534 1 report
T1537 1 report
T1538 1 report
T1543 1 report
T1543.002 1 report
T1543.003 1 report
T1543.004 1 report
T1546 1 report
T1546.003 1 report
T1546.004 1 report
T1546.008 1 report
T1546.012 1 report
T1546.015 1 report
T1547 1 report
T1547.001 1 report
T1547.002 1 report
T1547.005 1 report
T1547.009 1 report
T1548 1 report
T1548.002 1 report
T1550 1 report
T1550.001 1 report
T1550.002 1 report
T1554 1 report
T1556 1 report
T1556.006 1 report
T1556.009 1 report
T1559 1 report
T1560 1 report
T1560.001 1 report
T1560.002 1 report
T1565 1 report
T1565.001 1 report
T1566 1 report
T1566.001 1 report
T1566.002 1 report
T1566.003 1 report
T1566.004 1 report
T1567 1 report
T1567.001 1 report
T1567.002 1 report
T1569 1 report
T1569.002 1 report
T1570 1 report
T1571 1 report
T1572 1 report
T1573 1 report
T1573.001 1 report
T1573.002 1 report
T1574 1 report
T1574.001 1 report
T1574.011 1 report
T1578 1 report
T1580 1 report
T1583 1 report
T1583.003 1 report
T1584 1 report
T1585 1 report
T1585.002 1 report
T1587 1 report
T1587.003 1 report
T1588 1 report
T1588.003 1 report
T1588.004 1 report
T1588.007 1 report
T1595 1 report
T1595.002 1 report
T1598 1 report
T1602 1 report
T1602.001 1 report
T1602.002 1 report
T1608 1 report
T1608.001 1 report
T1608.002 1 report
T1608.003 1 report
T1608.004 1 report
T1608.005 1 report
T1608.006 1 report
T1613 1 report
T1614 1 report
T1614.001 1 report
T1615 1 report
T1619 1 report
T1622 1 report
T1652 1 report
T1654 1 report
T1657 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

CVE-2020-3529
CVE-2023-23397 KEV
CVE-2023-27532 KEV ransomware
CVE-2023-46805 KEV ransomware
CVE-2023-48788 KEV ransomware
CVE-2024-0012 KEV ransomware
CVE-2024-21887 KEV ransomware
CVE-2024-21893 KEV ransomware
CVE-2024-21983
CVE-2024-30080
CVE-2024-3400 KEV ransomware
CVE-2024-47575 KEV

Show all 14 CVEs Show fewer

CVE-2024-9474 KEV ransomware
CVE-2026-21236

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

16 June 2026

Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT
9 April 2026

Updating: Two Telegram channels and two accounts banned, one bounty offered, and BreachForums goes down - DataBreaches.Net

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Updating: Two Telegram channels and two accounts banned, one bounty offered, and BreachForums goes down - DataBreaches.Net
9 April 2026

Scattered Spider has a new Telegram channel to list its attacks - DataBreaches.Net

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Scattered Spider has a new Telegram channel to list its attacks - DataBreaches.Net
6 April 2026

Pure Storage confirms data breach after Snowflake account hack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Pure Storage confirms data breach after Snowflake account hack
6 April 2026

Cylance confirms data breach linked to 'third-party' platform

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cylance confirms data breach linked to 'third-party' platform
6 April 2026

Canadian Suspect Arrested Over Snowflake Customer Breach and Extortion Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Canadian Suspect Arrested Over Snowflake Customer Breach and Extortion Attacks
28 August 2025

The Phantom Threat: Inside UNC5518’s Invisible Empire of MetaStealer Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Phantom Threat: Inside UNC5518’s Invisible Empire of MetaStealer Operations
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
20 June 2024

Snowflake Threat Hunting Guide

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Snowflake Threat Hunting Guide
17 June 2024

17th June – Threat Intelligence Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 17th June – Threat Intelligence Report

Show all 18 reports Show fewer

10 June 2024

UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
8 December 2023

Approaching stealers devs : a brief interview with Meta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Approaching stealers devs : a brief interview with Meta
9 May 2023

MetaStealer: String Decryption and DGA overview

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MetaStealer: String Decryption and DGA overview
5 December 2022

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
29 August 2022

Traffers: a deep dive into the information stealer ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Traffers: a deep dive into the information stealer ecosystem
13 July 2022

Evolving Info-Stealers: RedLine, Raccoon & New Threats

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Evolving Info-Stealers: RedLine, Raccoon & New Threats
20 May 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
6 April 2022

Windows MetaStealer Malware - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Windows MetaStealer Malware - SANS Internet Storm Center

Newest first. Details opens the report in Explore.