UNC6395Threat actor
The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials. After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments.From MISP Galaxy
Last reported 30 days ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1078Valid Accounts
“API requests for configuration information on Salesforce Communities & Sites instances (T1078 - Valid Accounts)”
- T1110Brute Force
“High frequency of failed login attempts using weak MFA methods (T1110 - Brute Force)”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1528Steal Application Access Token
“Login events using OAuth authentication (T1528 - Steal Application Access Token)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Gotta Breach 'Em All! The Journey Of ShinyHunters“UNC6395 for the separate Salesloft Drift campaign, which Google explicitly did not attribute to ShinyHunters but is closely related to SLSH.”
-
Mapping out your unknown: A threat hunter’s guide to Salesforce“Following the attack chain for GRUB1/UNC6395, detailed in Cloudflare’s Salesloft incident response blog post and in the Google Threat Intelligence Group’s report, we see a combination of requests to different API endpoints to discover what data entities are available for exfiltra…”
Indicators in its reports
named in the reports above- security[.]orgin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- evt[.]namein 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.