Salesforce Sounds Alarm Over Fresh Data Extortion Campaign

A prolific and noisy cybercrime gang with a penchant for stealing Salesforce customers’ data and holding it ransom is taking advantage of misconfigured guest accounts meant to provide public access to services meant to remain private.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Salesforce said the resulting data theft and extortion campaign doesn’t trace to a vulnerability in its platform. Attackers have successfully exploited guest account misconfigurations to steal an organization’s Salesforce customer data.

The cybercrime collective, lately doing its illicit business under the ShinyHunters banner, has claimed credit for the campaign. The group told BleepingComputer the victims include numerous cybersecurity firms, and number between 300 and 400 organizations.

The data theft appears to tie to misconfigured rapid development framework components, called Salesforce Aura, that underpin Salesforce Experience Cloud. Formerly known as Community Cloud, the platform is designed to connect an organization’s customer relationship management data with online portals, forums or websites.

Salesforce said the attackers appear to have modified an open-source tool called Aura Inspector “to perform mass scanning of public-facing Experience Cloud sites” and to extract data from any sites with “overly permissive guest user settings.”

Aura Inspector is a command-line tool, released Jan. 12 by Google Cloud’s Mandiant, designed to help defenders audit their Experience Cloud environments and spot when objects and fields which are not intended to be made publicly available are being publicly exposed, so they can lock them down.

“While the original Aura Inspector is limited to identifying vulnerable objects by probing API endpoints that these sites expose (specifically the /s/sfsites/aura endpoint), the actor has developed a custom version of the tool capable of going beyond identification to actually extract data – exploiting overly permissive guest user settings,” Salesforce said.

Mandiant said it’s investigating the malicious use of the tool it developed.

“We are aware of a threat actor attempting to identify misconfigurations within the Salesforce Experience Cloud instances. We are working closely with Salesforce and our customers to provide the necessary telemetry and detection rules to mitigate potential risk,” Charles Carmakal, CTO of Mandiant Consulting, told Information Security Media Group.

Salesforce recommends that Experience Cloud-using customers immediately audit all guest account permissions and enforce a “least privilege access model.” Change default permissions to be “private,” so that any guest account access must be explicitly enabled. Also disable all public API use for the environment, so that guest accounts cannot make unauthenticated API calls. “This is the highest-impact single change you can make. It closes the Aura endpoint to unauthenticated API queries, which is the exact vector used in this campaign,” Salesforce said.

Other recommendations: deactivate portal or site visibility for guest accounts, to block an attacker-controlled guest account from being able to enumerate other users. If not needed, organizations can also deactivate the ability to self-register a portal account, which could be used by an attacker to escalate “a guest-tier exposure into an authenticated session with broader data access,” Salesforce said.

ShinyHunters first claimed credit for this campaign in a recent post to its darkweb data leak site, where it lists non-paying victims to try and pressure them into changing their mind. The group has badged the effort as being its “Salesforce Aura Campaign” and claims to be extorting “several hundreds of companies” that use Aura.

As is typical for ransomware operations, the crime gang doesn’t disclose if any victims did pay a ransom, what amount or when.

ShinyHunters crosses over with other elements of the largely Western adolescent cybercrime community known as The Com, including groups operating under such banners as “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters” and “SLSH.” Members of the group regularly engage in social engineering attacks, oftentimes in live telephone calls targeting an organization’s IT help desk (see: Voice Phishing Okta Customers: ShinyHunters Claims Credit).

A previous group that specialized in data extortion, also called ShinyHunters, appears to have no connection to the group now bearing that name since 2025, experts said.

The repeat targeting of Salesforce customers’ CRM data by ShinyHunters verges on the obsessional. Previous campaigns by the group haven’t exploited any vulnerabilities in the Salesforce, but typically by targeting third-party services that integrate with the platform.

Last year, the group claimed to steal data from 760 Salesloft Drift-using organizations, amounting to 1.5 billion records culled for the likes of Cisco, Disney, KFC, Ikea, Marriott, McDonald’s, Walgreens, as well as grocery giant Albertsons and retailer Saks Fifth Avenue (see: Salesforce Rebuffs ShinyHunters Extortionists’ Ransom Demand).

In a Tuesday update to its data leak site, ShinyHunters attempted to increase the pressure on non-paying victims by warning that its message stood as a final warning “before we release your name with final warning or a complete data leak.”

Cybersecurity experts recommend never paying the group, or even making contact.

Unit 221B, a cybersecurity firm that has outed members of The Com – and been targeted in reprisal – said that ShinyHunters specializes in “harassment and negative PR” for victims, including death threats against victims’ senior executives.

The firm recommends never opening communications, never mind negotiations, with any Com entity, warning that by doing so, victims will signal that they perceive their stolen data to pose value, thus leading to further extortion shakedowns.

Security experts said no cybercrime group, whatever its claims or the supposed evidence furnished, has ever deleted any stolen data, regardless of whether it received a ransom in exchange for a promise to do so.

Despite ShinyHunters’ repeat targeting of organizations’ Salesforce CRM data and loudly proclaiming that fact, ransomware incident responders report that these types of data theft and extortion campaigns appear to be resulting in very few victims actually paying any ransom (see: Victims Are Rebuffing Ransomware Mass Data Theft Campaigns).