Google and Cisco Report CRM Software Breaches via Vishing

Technology giants Google and Cisco separately said they’ve both suffered recent data breaches after attackers socially engineered their employees.

See Also: Why Cyberattackers Love ‘Living Off the Land’

In both cases, the attacks involved voice phishing, also known as vishing, and led to a breach of customer data being stored in their cloud-based customer relationship management software.

Their breach notifications arrive amidst an ongoing wave of such attacks, often attributed to individuals with ties to the ShinyHunters extortion group or collective.

Google on Tuesday said the attack against it succeeded in June, and involved a breach of data being stored in one of its Salesforce cloud-based CRM software instances.

“The instance was used to store contact information and related notes for small and medium businesses,” Google said. “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off. The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.”

Google’s alert followed Cisco on Friday detailing its own vishing attack, which came to light on July 24 and resulted in the attacker successfully accessing and exporting customer data from its cloud-based CRM system.

“Upon learning of the incident, the actor’s access to that CRM system instance was immediately terminated and Cisco commenced an investigation,” Cisco said. “Our investigation has determined that the exported data primarily consisted of basic account profile information of individuals who registered for a user account on Cisco.com.”

Exposed data included a customer’s name, the name of their organization, a Cisco-assigned user ID, plus email address, phone number and account-related metadata, such as the account creation date. The vendor said the attack exposed no “confidential or proprietary information or any passwords or other types of sensitive information,” and didn’t affect any Cisco products or services.

Cisco said it’s working with law enforcement and data protection authorities to investigate the incident as well as notify individuals affected by the breach. The company didn’t immediately respond to a request for comment about whether its breached CRM software was a Salesforce instance.

“We apologize for any inconvenience or concern that this incident may have caused,” Cisco said.

Cisco and Google both have yet to detail how the attacks came to light, if they’ve received extortion demands or how many customers were impacted.

Cisco has pledged to strengthen its anti-vishing defenses. “Every cybersecurity incident is an opportunity to learn, strengthen our resilience, and help the wider security community,” it said. “We are implementing further security measures to mitigate the risk of similar incidents occurring in the future, including re-educating personnel on how to identify and protect against potential vishing attacks.”

Phishing Precedes Extortion

Google’s public data breach notification, perhaps ironically, arrived in the form of an update to a security alert published on June 4 by its own Google Threat Intelligence Group, “The Cost of a Call: From Voice Phishing to Data Extortion,” which detailed tactics, techniques and procedures being used by a specific group of attackers against multiple Salesforce customers (see: Salesforce, Okta Targeted by Telephone-Wielding Hackers).

In many cases, the attackers attempted to trick help desks into authorizing a malicious connection to the organization’s Salesforce portal, which allows them to access data, run queries and exfiltrate information.

GTIG tracks these attacks using the codename UNC6040, and said that group regularly attempts to extort victims, sometimes “several months after the initial data theft,” by demanding a ransom payable in Bitcoin within 72 hours.

“During these communications, UNC6240 has consistently claimed to be the threat group ShinyHunters,” it said, including via extortion notes sent from such email addresses as shinygroup@tuta[.]com and shinycorp@tuta[.]com.

Following in the footsteps of many ransomware groups, Google warned that ShinyHunters may also be preparing a data leak site, to attempt to “name and shame” victims into paying.

Google said that after breaching a victim’s Salesforce environment, it’s also seen cases in which UNC6040 used end-user credentials that it previously obtained – potentially through information stealing malware or vishing attacks – “to move laterally through victim networks, accessing and exfiltrating data from the victim’s accounts on other cloud platforms such as Okta and Microsoft 365.”

While attackers in multiple cases have claimed to be part of ShinyHunters, Google said that more broadly, they use TTPs that it’s tied to the broader cybercrime collective known as “The Com,” which has also birthed groups such as Scattered Spider. The overlapping TTPs used across the numerous vishing attacks observed have included “social engineering via IT support, the targeting of Okta credentials and an initial focus on English-speaking users at multinational companies,” Google said.

Rather than revealing the operations of a distinct group at work, “it’s plausible that these similarities stem from associated actors operating within the same communities, rather than indicating a direct operational relationship between the threat actors,” it said.

Other organizations recently hit by data breaches involving ShinyHunters gaining access to their Salesforce instances include retailers Adidas and Victoria’s Secret, luxury fashion house Chanel, LVMH brands Dior, Louis Vuitton and Tiffany, insurer Allianz Life and Australian airline Quantas.

In what may also be a ShinyHunters attack, Danish jewelry company Pandora on Tuesday disclosed a breach in which “some customer information was accessed through a third-party platform that we use.”