45[.]27[.]26[.]205

Sample VPS exfiltration IP (ALEXHOST SRL, AS200019) used by UNC5537 to stage stolen Snowflake-customer data. Listed in Mandiant's June 2024 disclosure.

first seen

May 21, 2024

publisher

Mandiant (Google Cloud)