Google’s Threat Intelligence Group (GTIG) has revealed that hackers harvested user credentials from Salesforce customers in a widespread campaign during the first half of this month.
The attacker, tracked as UNC6395, targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.
"The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials," researchers said in an advisory.
"After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments."
These secrets included sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens.
"The techniques used in this campaign weren’t novel in terms of exploitation. The attacker didn’t need to break Salesforce itself, they abused OAuth tokens from a widely used and trusted third-party integration to gain access," commented Cory Michal, CSO of AppOmni.
"They then used that foothold in a very disciplined and methodical way. They ran structured SOQL queries, targeted high-value data like credentials, and attempted to cover their tracks by deleting jobs."
Salesloft, working with Salesforce, has now revoked all active access and refresh tokens within the Drift application. Salesforce has also removed the Drift application from the Salesforce AppExchange until further notice, pending further investigation.
While UNC6395 demonstrated operational security awareness by deleting query jobs, researchers said logs weren't affected. As such, organizations should still review relevant logs for evidence of data exposure.
They should search for sensitive information and secrets contained within Salesforce objects and take appropriate action, such as immediately revoking API keys, resetting passwords, rotating credentials, and reviewing permissions.
Researchers also urged enterprises to carry out investigations to determine whether any secrets have been abused.
“This campaign underscores that highly permissioned OAuth and SaaS-to-SaaS integrations represent one of the largest risks and blind spots for organizations today. Once an integration is compromised, attackers can operate with the same level of access granted to that app, often bypassing traditional MFA controls," said Michal.
"The risk is compounded if organizations are insecurely storing secrets, API keys, or credentials in Salesforce objects. In those cases, if the data was exfiltrated, it’s very likely that connected systems such as AWS, Snowflake, or VPNs have already been compromised as well. That makes the blast radius of these attacks far larger than just the SaaS application itself."
The report doesn't identify UNC6395, but the sophistication of the operation implies a state-sponsored attacker, Michal said.
"What’s most noteworthy about the UNC6395 attacks is both the scale and the discipline. This wasn’t a one-off compromise; hundreds of Salesforce tenants of specific organizations of interest were targeted using stolen OAuth tokens, and the attacker methodically queried and exported data across many environments," said Michal.
"The combination of scale, focus, and tradecraft makes this campaign stand out."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- A notorious hacker group is ramping up cloud-based ransomware attacks
- Hackers breached a 158 year old company by guessing an employee password
- Cyber criminals are abusing ConnectWise ScreenConnect, again
-
Hexaware partners with Replit to take secure 'vibe coding' to the enterpriseNews The new collaboration enables business teams to create secure, production-grade applications without the need for traditional coding skills
-
Stanford AI study shows AI is starting to take jobs, but wages aren't fallingNews AI may already be impacting early-career jobs, particularly roles featuring tasks that can be automated like software developers or customer service, according to Stanford researchers.
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Hackers are abusing ConnectWise ScreenConnect, againNews A new spear phishing campaign has targeted more than 900 organizations with fake invitations from platforms like Zoom and Microsoft Teams.
-
AI means cyber teams are rethinking their approach to insider threatsNews Nearly two-thirds of European cybersecurity professionals see insider threats as their biggest security risk – and AI is making things worse.
-
74% of companies admit insecure code caused a security breachNews A large number of data breaches are linked to insecure code, prompting calls for better training
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Cyber pros say the buck stops with the board when it comes to security failingsNews Fines, sanctions, and even prosecution are all on the table when it comes to cyber failings, practitioners believe
-
Microsoft quietly launched an AI agent that can detect and reverse engineer malwareNews Researchers say the tool is already achieving the “gold standard” in malware classification
-
Employee distraction is now your biggest cybersecurity riskNews Workplace distraction is the top reason organizations fall victim to cyber attacks, according to new research.
