Salesloft Drift hackers had access to company GitHub account for months before attacks

Hackers behind the Salesloft Drift breach had access to the company’s GitHub account for several months before waging a flurry of attacks, the company has revealed.

The breach, which has been attributed to the UNC6395 hacking group, led to a series of attacks this summer that affected hundreds of companies including Google, Zscaler, Cloudflare, and Palo Alto Networks.

Attackers were able to access secrets including AWS access keys, passwords, Snowflake-related access tokens, and sales data.

30% off Keeper Security's Business Starter and Business plans

Keeper Security is trusted and valued by thousands of businesses and millions of employees. Why not join them and protect your most important assets while taking advantage of this special offer?

ITpro Approved - Sponsored offerView Deal

Mandiant was initially hired to investigate the root cause and scope of the incident, and to help Salesloft with containment and remediation – after which it was asked to verify the segmentation between the Drift and Salesloft environments.

Between March and June this year, Mandiant found the threat actor(s) accessed the Salesloft GitHub account, using this access to download content from multiple repositories, add a guest user, and establish workflows.

At the same time, the investigation found attackers were carrying out reconnaissance activities in Salesloft and Drift application environments.

The attackers then accessed Drift’s AWS environment and obtained OAuth tokens for Drift customers’ technology integrations, which they then used to access data via Drift integrations.

"Based on the Mandiant investigation, the findings support the incident has been contained. The focus of Mandiant’s engagement has now transitioned to forensic quality assurance review," said Salesloft.

The company has now taken remediation measures and restored the integration between the Salesloft platform and Salesforce.

Salesloft security practices questioned

Cory Michal, CSO of AppOmni, is critical of Salesloft's security stance prior to the discovery of the attack. Michal said the length of exposure “strongly suggests there was little to no effective security monitoring” in place.

“A dwell time of several months, spanning from March to June, is a long time for an adversary to remain active in a source code repository without detection,” he said.

“In this case, not only was reconnaissance activity taking place, but a guest user was added and workflows were established, indicating the attacker was able to operate with persistence and intentionality.”

In retrospect, Salesloft should have been actively logging and alerting on anomalous activity, such as new external users or workflow creation. This, he added, would have allowed the intrusion to have been identified much earlier.

"One important point to add is that GitHub, like Salesforce or any other business platform, is ultimately just another SaaS application. A mature security program requires not only knowing which SaaS products are in use across the environment, but also hardening them against attacks and continuously monitoring for suspicious activity," he said.

"This incident underscores the risks of overlooking those fundamentals. Salesloft has unfortunately learned this lesson the hard way.”

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

• Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malware
• Lack of visibility creates "cascade" of security risk
• Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victim