{ "Event": { "analysis": "2", "date": "2025-09-05", "extends_uuid": "", "info": "OSINT - Widespread Data Theft Targets Salesforce Instances via Salesloft Drift", "publish_timestamp": "1757072225", "published": true, "threat_level_id": "4", "timestamp": "1757072192", "uuid": "de0e2e6b-18d8-4237-a852-5877b3ddab58", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Google Cloud Blog\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Instance Metadata API - T1552.005\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Additional Cloud Credentials - T1098.001\"", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": "" }, { "colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" } ], "Attribute": [ { "category": "Network activity", "comment": "DigitalOcean", "deleted": false, "disable_correlation": false, "timestamp": "1757071673", "to_ids": true, "type": "ip-dst", "uuid": "85b0cb72-9ffa-4f21-843a-0e0a1ef1e5fa", "value": "208.68.36.90" }, { "category": "Network activity", "comment": "Amazon Web Services", "deleted": false, "disable_correlation": false, "timestamp": "1757071691", "to_ids": true, "type": "ip-dst", "uuid": "90257bd5-159e-4793-aab3-bac1d5205ef5", "value": "44.215.108.109" }, { "category": "Payload delivery", "comment": "risk of FP - weak indicator", "deleted": false, "disable_correlation": false, "timestamp": "1757071746", "to_ids": false, "type": "user-agent", "uuid": "f700cfff-920b-4490-8dae-bbaa2fbd67c7", "value": "python-requests/2.32.4" }, { "category": "Payload delivery", "comment": "risk of FP - weak indicator", "deleted": false, "disable_correlation": false, "timestamp": "1757071804", "to_ids": false, "type": "user-agent", "uuid": "4d53edbc-707e-4699-8a11-648c9f7779e8", "value": "Python/3.11 aiohttp/3.12.15" }, { "category": "Network activity", "comment": "Malicious User-Agent string", "deleted": false, "disable_correlation": false, "timestamp": "1757071839", "to_ids": true, "type": "user-agent", "uuid": "a8c0594d-a65e-48a4-b650-c103905abe73", "value": "Salesforce-Multi-Org-Fetcher/1.0" }, { "category": "Network activity", "comment": "Malicious User-Agent string", "deleted": false, "disable_correlation": false, "timestamp": "1757071839", "to_ids": true, "type": "user-agent", "uuid": "c0637f09-1626-41cd-a359-a93eba77a43a", "value": "Salesforce-CLI/1.0" } ], "Object": [ { "comment": "Tor exit node used", "deleted": false, "description": "A domain/hostname and IP address seen as a tuple in a specific time frame.", "meta-category": "network", "name": "domain-ip", "template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734", "template_version": "11", "timestamp": "1757071932", "uuid": "f40fb619-2a74-45a2-83d5-977b06ba6ff5", "Attribute": [ { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "f398868c-27c8-4d6a-a224-20fa1c1994ba", "value": "154.41.95.2" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "583183bd-4c10-4520-b8d3-170d0076c3f6", "value": "176.65.149.100" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "7f80ddc1-36cc-4345-af8b-068d9c9c53d9", "value": "179.43.159.198" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "ce7876c5-8f2b-4c3a-9f43-6238f3934c20", "value": "185.130.47.58" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "de00a0d6-76bd-4f39-93be-d85075aa829d", "value": "185.207.107.130" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "5b397052-9ab0-4951-a55c-18b751d70621", "value": "185.220.101.133" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "2d7cfe54-7ac7-4681-95f2-950843a882d2", "value": "185.220.101.143" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "59c4e18d-392e-411d-8962-87c33ed30910", "value": "185.220.101.164" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "b19123ef-9291-4cf0-a132-6c8350bf0421", "value": "185.220.101.167" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "e306a5f8-d7e2-4d4a-a99e-760a206d31bb", "value": "185.220.101.169" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "c7f1a7c5-d244-4ab1-90e9-70ef8aaf5faa", "value": "185.220.101.180" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "e6a26fa1-e0c9-4016-b881-eaf0e4f16263", "value": "185.220.101.185" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "d4001608-9e16-4c48-a289-ffb6fcd863bf", "value": "185.220.101.33" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "12e92580-a562-4d4d-b8d9-35287a3a7df5", "value": "192.42.116.179" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "21ad7894-5c36-4c35-bd13-596597dab2a0", "value": "192.42.116.20" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "603cf5b4-ef54-4e5d-be16-ff33f7ff2c09", "value": "194.15.36.117" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "dde649ae-afb0-4a8c-ace1-359511af8f88", "value": "195.47.238.178" }, { "category": "Network activity", "comment": "Tor exit node", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1757071932", "to_ids": true, "type": "ip-dst", "uuid": "4e6a3c9d-fe28-49f4-bc9d-b3d2538c57b1", "value": "195.47.238.83" } ] }, { "comment": "", "deleted": false, "description": "Report object to describe a report along with its metadata.", "meta-category": "misc", "name": "report", "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", "template_version": "8", "timestamp": "1757072036", "uuid": "236c4657-dbf0-4ae7-b4f5-5b454496635d", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "link", "timestamp": "1757072036", "to_ids": false, "type": "link", "uuid": "fe9f96ad-1abd-42ff-a386-be039ee6043c", "value": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "summary", "timestamp": "1757072036", "to_ids": false, "type": "text", "uuid": "0b336daa-3349-49da-bcbb-154fd44ac7d9", "value": "Google Threat Intelligence Group (GTIG) is issuing an advisory to alert organizations about a widespread data theft campaign, carried out by the actor tracked as UNC6395. Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.\r\n\r\nThe actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials. After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments. GTIG observed UNC6395 targeting sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens. UNC6395 demonstrated operational security awareness by deleting query jobs, however logs were not impacted and organizations should still review relevant logs for evidence of data exposure.\r\n\r\nBased on data available at the time, Salesloft indicated that customers that do not integrate with Salesforce are not impacted by this campaign.\r\n\r\nOn Aug. 20, 2025 Salesloft, in collaboration with Salesforce, revoked all active access and refresh tokens with the Drift application. In addition, Salesforce removed the Drift application from the Salesforce AppExchange until further notice pending further investigation. This issue does not stem from a vulnerability within the core Salesforce platform.\r\n\r\nGTIG, Salesforce, and Salesloft have notified impacted organizations." }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "title", "timestamp": "1757072036", "to_ids": false, "type": "text", "uuid": "2268d2d2-c4ce-42f9-89d3-455affe6e1b3", "value": "Widespread Data Theft Targets Salesforce Instances via Salesloft Drift" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "type", "timestamp": "1757072036", "to_ids": false, "type": "text", "uuid": "af17860a-6055-4997-ae2c-8dee5dffbd53", "value": "Blog" } ] } ], "EventReport": [ { "name": "Report from - https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift (1757071634)", "content": "Threat Intelligence\n\n# Widespread Data Theft Targets Salesforce Instances via Salesloft Drift\n\nAugust 26, 2025\n\n##### Google Threat Intelligence Group\n\n##### Mandiant\n\n##### Cyber Defense Summit 2025\n\nThreat insights and defense tactics from experts on the frontlines.\n\nRegister now\n\nWritten by: Austin Larsen, Matt Lin, Tyler McLellan, Omar ElAhdan\n\n---\n\n### Update (August 28)\n\nBased on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations. We now advise all Salesloft Drift customers to **treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised**.\n\nOn August 28, 2025, our investigation confirmed that the actor also compromised OAuth tokens for the \"Drift Email\" integration. On August 9, 2025, a threat actor used these tokens to access email from a very small number of Google Workspace accounts. The only accounts that were potentially accessed were those that had been specifically configured to integrate with Salesloft Drift; the actor would not have been able to access any other accounts on a customer's Workspace domain.\n\nIn response to these findings and to protect our customers, Google identified the impacted users, revoked the specific OAuth tokens granted to the Drift Email application, and disabled the integration functionality between Google Workspace and Salesloft Drift pending further investigation. We are notifying all impacted Google Workspace administrators. To be clear, there has been no compromise of Google Workspace or Alphabet itself.\n\nWe recommend organizations take immediate action to review all third-party integrations connected to their Drift instance, revoke and rotate credentials for those applications, and investigate all connected systems for signs of unauthorized access.\u00a0\n\nSalesloft has now engaged Mandiant to assist in their investigation. See Salesloft\u2019s updated advisory for more details.\n\n---\n\n### Introduction\n\nGoogle Threat Intelligence Group (GTIG) is issuing an advisory to alert organizations about a widespread data theft campaign, carried out by the actor tracked as UNC6395. Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.\n\nThe actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials. After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments. GTIG observed UNC6395 targeting sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens. UNC6395 demonstrated operational security awareness by deleting query jobs, however logs were not impacted and organizations should still review relevant logs for evidence of data exposure.\n\nBased on data available at the time, Salesloft indicated that customers that do not integrate with Salesforce are not impacted by this campaign.\n\nOn Aug. 20, 2025 Salesloft, in collaboration with Salesforce, revoked all active access and refresh tokens with the Drift application. In addition, Salesforce removed the Drift application from the Salesforce AppExchange until further notice pending further investigation. This issue does not stem from a vulnerability within the core Salesforce platform.\n\nGTIG, Salesforce, and Salesloft have notified impacted organizations.\n\n### Threat Detail\n\nThe threat actor executed queries to retrieve information associated with Salesforce objects such as Cases, Accounts, Users, and Opportunities. For example, the threat actor ran the following sequence of queries to get a unique count from each of the associated Salesforce objects.\n\n```\nSELECT COUNT() FROM Account;\r\n\r\nSELECT COUNT() FROM Opportunity;\r\n\r\nSELECT COUNT() FROM User;\r\n\r\nSELECT COUNT() FROM Case;\n```\n\n#### Query to Retrieve User Data\n\n```\nSELECT Id, Username, Email, FirstName, LastName, Name, Title, CompanyName, \r\nDepartment, Division, Phone, MobilePhone, IsActive, LastLoginDate, \r\nCreatedDate, LastModifiedDate, TimeZoneSidKey, LocaleSidKey, \r\nLanguageLocaleKey, EmailEncodingKey \r\nFROM User \r\nWHERE IsActive = true\r\nORDER BY LastLoginDate DESC NULLS LAST \r\nLIMIT 20\n```\n\n#### Query to Retrieve Case Data\n\n```\nSELECT Id, IsDeleted, MasterRecordId, CaseNumber \r\nFROM Case\r\nLIMIT 10000\n```\n\n### Recommendations\n\nGiven GTIG's observations of data exfiltration associated with the campaign, organizations using Salesloft Drift to integrate with third-party platforms (including but not limited to Salesforce) should consider their data compromised and are urged to take immediate remediation steps.\n\nImpacted organizations should search for sensitive information and secrets contained within the integrated platforms and take appropriate action, such as revoking API keys, rotating credentials, and performing further investigation to determine if the secrets were abused by the threat actor.\n\nInvestigate for Compromise and Scan for Exposed Secrets\n\n* Review all third-party integrations associated with an organization's Drift instance (accessible within the Drift Admin settings page).\n* Within each integrated third-party application, search for the IP addresses and User-Agent strings provided in the IOCs section below. While this list includes IPs from the Tor network that have been observed to date, Mandiant recommends a broader search for any activity originating from Tor exit nodes.\n* Review Salesforce Event Monitoring logs for unusual activity associated with the Drift connection user.\n* Review authentication activity from the Drift Connected App.\n* Review UniqueQuery events that log executed SOQL queries.\n* Open a Salesforce support case to obtain specific queries used by the threat actor.\n* Search Salesforce objects for potential secrets, such as:\n\n+ `AKIA` for long-term AWS access key identifiers\n+ `Snowflake` or `snowflakecomputing.com` for Snowflake credentials\n+ `password`, `secret,key` to find potential references to credential material\n+ Strings related to organization-specific login URLs, such as VPN or SSO login pages\n\n* Run tools like Trufflehog to find secrets and hardcoded credentials.\n\nRevoke and Rotate Credentials\n\n* Within each integrated third-party application, revoke and rotate API keys, credentials. and authentication tokens associated with third-party application integrations with a Drift instance.\n* Immediately revoke and rotate any discovered keys or secrets.\n* Reset passwords for associated user accounts.\n* For Salesforce integrations, configure session timeout values in Session Settings to limit the lifespan of a compromised session.\n\nHarden Access Controls\n\n* Review and Restrict Connected App Scopes: Ensure that applications have the minimum necessary permissions and avoid overly permissive scopes like `full` access.\n* Enforce IP Restrictions on the Connected App: In the app's settings, set the \"IP Relaxation\" policy to \"Enforce IP restrictions.\"\n* Define Login IP Ranges: On user profiles, define IP ranges to only allow access from trusted networks.\n* Remove the \"API Enabled\" Permission: Remove the \"API Enabled\" permission from profiles and grant it only to authorized users via a Permission Set.\n\nAdditional instructions and updates are available on the Salesloft Trust Center and Salesforce advisory.\u00a0\n\n### Acknowledgments\n\nWe would like to thank Salesforce, Salesloft, and other trusted partners for their collaboration and assistance in responding to this threat.\n\n### IOCs\n\nThe following indicators of compromise are available in\u00a0a Google Threat Intelligence (GTI) collection for registered users.\n\n| | |\n| --- | --- |\n| **Indicator Value** | **Description** |\n| Salesforce-Multi-Org-Fetcher/1.0 | Malicious User-Agent string |\n| Salesforce-CLI/1.0 | Malicious User-Agent string |\n| python-requests/2.32.4 | User-Agent string |\n| Python/3.11 aiohttp/3.12.15 | User-Agent string |\n| 208.68.36.90 | DigitalOcean |\n| 44.215.108.109 | Amazon Web Services |\n| 154.41.95.2 | Tor exit node |\n| 176.65.149.100 | Tor exit node |\n| 179.43.159.198 | Tor exit node |\n| 185.130.47.58 | Tor exit node |\n| 185.207.107.130 | Tor exit node |\n| 185.220.101.133 | Tor exit node |\n| 185.220.101.143 | Tor exit node |\n| 185.220.101.164 | Tor exit node |\n| 185.220.101.167 | Tor exit node |\n| 185.220.101.169 | Tor exit node |\n| 185.220.101.180 | Tor exit node |\n| 185.220.101.185 | Tor exit node |\n| 185.220.101.33 | Tor exit node |\n| 192.42.116.179 | Tor exit node |\n| 192.42.116.20 | Tor exit node |\n| 194.15.36.117 | Tor exit node |\n| 195.47.238.178 | Tor exit node |\n| 195.47.238.83 | Tor exit node |\n\nPosted in\n\n* Threat Intelligence\n\n##### Related articles\n\nThreat Intelligence\n\n### ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)\n\nBy Mandiant \u2022 28-minute read\n\nThreat Intelligence\n\n### Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats\n\nBy Google Threat Intelligence Group \u2022 19-minute read\n\nThreat Intelligence\n\n### A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor\n\nBy Mandiant \u2022 33-minute read\n\nThreat Intelligence\n\n### Beyond Convenience: Exposing the Risks of VMware vSphere Active Directory Integration\n\nBy Mandiant \u2022 31-minute read", "id": "1783", "event_id": "339802", "timestamp": "1757071634", "uuid": "9e388f7e-8d6e-4cc2-87d3-79915a66f5d0", "deleted": false } ] } }