Data Is the New Diamond: Latest Moves by Hackers and Defenders

There have been ongoing developments in data theft activity targeting Salesforce instances, with the Salesloft Drift supply chain attack highlighted in a recent Unit 42 Threat Brief. The attacks are attributed by Google to UNC6395, a threat activity cluster focused on stealing credentials and data from Salesforce objects, while it remains unclear if this is linked to targeting of Salesforce tenants by UNC6040 and Bling Libra.

Threat actors claiming ties to Muddled Libra and Bling Libra have formed Telegram channels boasting extensive data theft extortion, and some members have been linked to a new RaaS named ShinySpider that they claim could reach encryption speeds of one GB per second; as of September 5, some channels have been banned or disabled. As noted in Unit 42 insights on Muddled Libra, many of these actors are likely affiliated with The Com, employing social engineering over zero‑day exploits.

Salesforce has announced that, beginning this month, it will restrict end users from using uninstalled connected applications to hinder attackers accessing exfiltrated data. One member of Muddled Libra was sentenced to 10 years in federal prison and ordered to pay more than $13 million in restitution, with observers noting this as a potential deterrent for others in The Com.