ShinyHunters Counts 1.5 Billion Stolen Salesforce Records

The extortionists behind data-grabbing attacks on Salesloft Drift users claim to have stolen 1.5 billion Salesforce records from 760 companies.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Hackers using the moniker ShinyHunters claimed responsibility. The group, which joined forces with the loose cybercriminal collectives Spider and Lapsus$, now collectively call themselves Scattered Lapsus$ Hunters. They continue to specialize in data theft and extortion, sometimes also unleashing ransomware inside an organization’s environment.

The FBI published Friday an advisory warning that the attackers steal OAuth tokens used to integrate the Salesloft Drift artificial intelligence chatbot with Salesforce instances. Google’s threat intelligence group previously reported that the attacks started as early as Aug. 8 and ran until Aug. 18, and that approximately 700 Salesloft customers fell victim.

ShinyHunters told BleepingComputer on Wednesday that one of their members first breached Salesloft’s GitHub repository and gained access to its private source code. They scanned the code using the free, legitimate TruffleHog security tool. TruffleHog is designed to find, verify and analyze leaked credentials such as API keys, database passwords and private encryption keys that end up in Git repositories, chats, wikis and other data stores, to help prevent attackers from finding and exploiting them.

ShinyHunters said TruffleHog rooted out OAuth tokens that facilitated access to 760 Salesloft customers that integrated their Drift email platform with their Salesforce instance.

Salesloft didn’t immediately respond to a Thursday request for comment on attackers’ claims.

Breaking into a GitHub account to look for tokens or other secrets inside repositories “is a method ShinyHunters/Lapsus$/Scattered Spider have used since 2020 (or even before) and it’s evidently still working,” Hudson Rock co-founder Alon Gal said in a recent LinkedIn post.

ShinyHunters shared proof of their data exfiltration with BleepingComputer, which reported that of the stolen records, “approximately 250 million were from the Account, 579 million from Contact, 171 million from Opportunity, 60 million from User and about 459 million records from the Case Salesforce tables.”

Google, in an Aug. 28 report about Shiny Hunters, which it tracks as UNC6395, found “the primary intent of the threat actor is to harvest credentials,” and that “after the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments.” This included “targeting sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords and Snowflake-related access tokens.”

Attackers also used OAuth tokens to access other applications integrated with Drift, including Google Workspace. Salesloft offers integrations to over 50 other tools besides Salesforce, including Eloqua, Facebook Analytics, Google Analytics, Marketo, Zapier and Zoom.

Working with Salesforce, Salesloft on Aug. 20 revoked and refreshed all active OAuth tokens for Drift, blocking further access by attackers.

Known victims of ShinyHunters’ data-grabbing efforts continue to come to light. They include BeyondTrust, Cato Networks, Cloudflare, CyberArk, JFrog, Nutanix, Palo Alto Networks, Proofpoint, Qualys, Rubrik, SpyCloud, Tenable and Zscaler.

A member of Scattered Lapsus$ Hunters claimed Friday the collective was “going dark” and had retired but security experts report seeing evidence to the contrary (see: Scattered Spider Tied to Fresh Attacks on Financial Services).