Google’s Threat Intelligence Group (GTIG) has revealed that hackers harvested user credentials from Salesforce customers in a widespread campaign during the first half of this month.
The attacker, tracked as UNC6395, targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.
"The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials," researchers said in an advisory.
"After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments."
These secrets included sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens.
"The techniques used in this campaign weren’t novel in terms of exploitation. The attacker didn’t need to break Salesforce itself, they abused OAuth tokens from a widely used and trusted third-party integration to gain access," commented Cory Michal, CSO of AppOmni.
"They then used that foothold in a very disciplined and methodical way. They ran structured SOQL queries, targeted high-value data like credentials, and attempted to cover their tracks by deleting jobs."
Salesloft, working with Salesforce, has now revoked all active access and refresh tokens within the Drift application. Salesforce has also removed the Drift application from the Salesforce AppExchange until further notice, pending further investigation.
While UNC6395 demonstrated operational security awareness by deleting query jobs, researchers said logs weren't affected. As such, organizations should still review relevant logs for evidence of data exposure.
They should search for sensitive information and secrets contained within Salesforce objects and take appropriate action, such as immediately revoking API keys, resetting passwords, rotating credentials, and reviewing permissions.
Researchers also urged enterprises to carry out investigations to determine whether any secrets have been abused.
“This campaign underscores that highly permissioned OAuth and SaaS-to-SaaS integrations represent one of the largest risks and blind spots for organizations today. Once an integration is compromised, attackers can operate with the same level of access granted to that app, often bypassing traditional MFA controls," said Michal.
"The risk is compounded if organizations are insecurely storing secrets, API keys, or credentials in Salesforce objects. In those cases, if the data was exfiltrated, it’s very likely that connected systems such as AWS, Snowflake, or VPNs have already been compromised as well. That makes the blast radius of these attacks far larger than just the SaaS application itself."
The report doesn't identify UNC6395, but the sophistication of the operation implies a state-sponsored attacker, Michal said.
"What’s most noteworthy about the UNC6395 attacks is both the scale and the discipline. This wasn’t a one-off compromise; hundreds of Salesforce tenants of specific organizations of interest were targeted using stolen OAuth tokens, and the attacker methodically queried and exported data across many environments," said Michal.
"The combination of scale, focus, and tradecraft makes this campaign stand out."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- A notorious hacker group is ramping up cloud-based ransomware attacks
- Hackers breached a 158 year old company by guessing an employee password
- Cyber criminals are abusing ConnectWise ScreenConnect, again
-
Invest in the future: Why PowerEdge is earning its place in 2025/2026 budgetsDell Technologies works with customers’ needs for performance and efficiency to ensure organizations are set up for success.
-
Lenovo ThinkBook 16 Gen 7 (Snapdragon) reviewReviews The combination of a high-capacity battery, an efficient Snapdragon chipset, and a low price makes the ThinkBook 16 Gen 7 an easy recommendation
-
Google wants to take hackers to courtNews You don't have a package waiting for you, it's a scam – and Google is fighting back
-
Laid off Intel engineer accused of stealing 18,000 files on the way outNews Intel wants the files back, so it's filed a lawsuit claiming $250,000 in damages
-
GitHub is awash with leaked AI company secrets – API keys, tokens, and credentials were all found out in the openNews Wiz research suggests AI leaders need to clean up their act when it comes to secrets leaking
-
When cyber professionals go rogue: A former ‘ransomware negotiator’ has been charged amid claims they attacked and extorted businessesNews The attackers are alleged to have demanded ransoms of up to $10 million
-
CISA just published crucial new guidance on keeping Microsoft Exchange servers secureNews With a spate of attacks against Microsoft Exchange in recent years, CISA and the NSA have published crucial new guidance for organizations to shore up defenses.
-
US telco confirms hackers breached systems in stealthy state-backed cyber campaign – and remained undetected for nearly a yearNews The hackers remained undetected in the Ribbon Communications’ systems for months
-
Google says reports of a 'huge' Gmail breach affecting millions of users are false, againNews Reports of a major Gmail affecting millions of users have been flooding the web this week – Google says they're "false" and you've nothing to worry about.
-
Enterprises can’t keep a lid on surging cyber incident costsNews With increasing threats and continuing skills shortages, AI tools are becoming a necessity for some
