Google Traces Salesforce Data Thefts to Salesloft Breach

The Salesforce Security Storm: How Stolen OAuth Tokens Fueled a Third-Party App Crisis

What happens when the very tools designed to streamline your business become the gateway for devastating data breaches? That’s the alarming reality facing enterprises after Google’s Threat Intelligence Group (GTIG) pinpointed the theft of OAuth tokens from the Salesloft Drift application as the cause of a significant wave of Salesforce-related security incidents. Between August 8th and 18th, attackers exploited this vulnerability to infiltrate integrated Salesforce databases, stealing sensitive customer and operational data. This incident underscores a critical Salesforce security challenge: the expanding threat surface introduced by third-party integrations and the potent danger of compromised OAuth tokens in the vast, interconnected SaaS ecosystem.

The Salesloft Drift Compromise: A Targeted Attack Vector

At the heart of this attack wave was Salesloft’s Drift app, a popular sales engagement platform designed to automate and personalize customer interactions. Its core value proposition lies in its deep Salesforce integration, seamlessly pulling crucial data – leads, contact information, account details, opportunity stages – from Salesforce into Drift to empower sales teams with context.

• The Integration’s Power (and Peril): The Drift-Salesforce link operates using OAuth 2.0, the standard protocol for delegated authorization. Users grant Drift permission (via tokens) to access specific subsets of Salesforce data as needed.
• The Attack Method: Attackers, tracked as UNC6395, uniquely focused on stealing these specific OAuth tokens associated with the Drift application. Crucially, this attack was distinct from compromising Salesforce itself directly.
• Exfiltration Tactics: Once armed with valid tokens, UNC6395 actors bypassed Salesforce perimeter defenses. GTIG observed them running targeted queries within Salesforce databases, specifically extracting:
  • Case data (customer support histories)
  • Account details (client company info)
  • User information (internal employee data)
  • Opportunity records (sales pipeline deals and values)

“Initial findings have shown that the actor’s primary objective was to steal credentials, specifically focusing on sensitive information like AWS access keys, passwords, and Snowflake-related access tokens.” – Salesloft Statement (Source: Provided Content).

This indicates attackers weren’t just seeking direct Salesforce data but were potentially using it as a stepping stone to discover other valuable credentials stored within Salesforce objects, aiming for broader cloud infrastructure compromise.

UNC6395: Separating This Campaign from the “Big Game” Hunters

This incident must be viewed against a backdrop of high-profile Salesforce data breaches impacting companies like Allianz Life, Workday, Qantas, and LVMH brands throughout the summer. However, GTIG explicitly states this wave is separate and unrelated to that activity.

• Different Threat Actors: The attacks on the larger brands have been widely attributed to the infamous ShinyHunters group (tracked as UNC6240), prolific “big game hunters” known for ransomware deployment, data theft, and extortion.
• Different Tactics: While both involve Salesforce, ShinyHunters-most-recent-campaigns#recent-campaigns-of-shinyhunters) typically employs a blend of credential theft (phishing, info stealers) and social engineering. UNC6395 focused squarely on OAuth token theft via a specific application.
• Different Scope: The ShinyHunters attacks often appear highly targeted towards extracting maximum extortion value from premium brands. While damaging, the Salesloft breach potentially impacted a broader range of companies using the integrated Drift platform.
• Motivation: UNC6395 displayed a credential-focused objective (AWS keys, Snowflake tokens) potentially for follow-on attacks or lateral movement, differing from ShinyHunters’ immediate high-value data extortion playbook.

Google’s insistence on distinguishing these campaigns highlights the diverse threats converging on enterprise SaaS ecosystems like Salesforce. Organizations face both broad-spectrum extortionists and more targeted credential thieves exploiting integration points.

Response and Remediation: The Cleanup Begins

Salesloft and GTIG initiated a coordinated response upon discovering the breach:

1. Token Mass Revocation: All active access and refresh tokens for the Drift-Salesforce integration were revoked globally. This instantly severed any attacker access gained through stolen tokens.
2. Forced Re-authentication: IT administrators must now manually re-authenticate the Drift-Salesforce connections within their organizations to generate new, uncompromised tokens. This creates a controlled cutoff point.
3. AppExchange Removal: Salesforce took the significant step of removing the Drift app entirely from its AppExchange marketplace. This suspension will remain pending Salesloft’s completion of its investigation and providing assurance that the platform is secure against similar future attacks. This action is relatively rare and signals the severity perceived by Salesforce.
4. Indicators of Compromise (IOCs): A comprehensive list of IOCs (IP addresses, domains, file hashes, patterns) was published. GTIG stressed that only Drift customers integrated with Salesforce needed to investigate for signs of compromise. Others using Drift independently were not affected.
5. Customer Notification: Salesloft and GTIG directly contacted all potentially affected customers based on their investigation findings.
6. Urgent Advisory: GTIG issued a stark warning: organizations using Drift integrated with Salesforce should “consider their Salesforce data compromised” and take immediate remediation steps.

Critical Next Steps for Impacted Organizations

GTIG’s advisory laid out a clear remediation path for impacted customers:

• Comprehensive Data Audit: Scrutinize all Salesforce objects for sensitive information and secrets that may have been exposed. This includes:
  • Database credentials
  • API keys (internal and third-party)
  • Google Cloud Platform service account keys (recommended for all Drift customers to check)
  • Private customer data inadvertently stored
  • Authentication tokens
• Immediate Credential Rotation: Revoke all exposed API keys and OAuth tokens discovered during the audit. Generate new, highly secure replacements using strong secrets.
• Password Reset: Enforce rotation for potentially exposed user passwords stored within Salesforce.
• Cloud Service Credential Review: Extend audits and rotations to linked cloud services like AWS and Snowflake, especially if access keys or tokens were found.
• Investigate for Abuse: Analyze logs (Salesforce, Drift, network, cloud providers) from the August 8-18 window to determine if compromised credentials were actively abused elsewhere – crucial for understanding the full blast radius.
• Re-authenticate with Caution: Only re-establish the Drift-Salesforce connection after Salesloft provides clear assurance of platform security and remediation.

The Core Security Lesson: OAuth and the Third-Party Integration Risk

The Salesloft Drift breach is a textbook case highlighting the inherent risks in modern SaaS application ecosystems:

• The OAuth Conundrum: OAuth streamlines integration but creates powerful access tokens. If these tokens are stolen – via app vulnerabilities, phishing targeting administrators, or client-side compromise – attackers inherit considerable application permissions silently. The trust invested in the token is exploited.
• Escalating Third-Party Risk: Integrations extend an organization’s attack surface beyond its direct control. A weakness in a third-party app like Drift can directly compromise a core system like Salesforce. The SolarWinds attack serves as a chilling precedent for supply-chain risks.
• Sensitive Data Proliferation: The incidental storage of highly sensitive credentials (AWS keys, passwords, Snowflake tokens) within SaaS platforms like Salesforce during integrations creates tempting targets. Organizations often fail to adequately monitor or purge these secrets (OWASP Security Risks Guide).
• The Over-Permissioning Problem: Granting third-party integrations overly broad access scopes within Salesforce increases the damage potential if those permissions are compromised through tokens (The Principle of Least Privilege).

Table: Key Attack Wave Comparison

Conclusion: Vigilance in the Era of SaaS Integrations

The exploitation of Salesloft Drift OAuth tokens marks a sophisticated and concerning evolution in attacking cloud ecosystems. It wasn’t a brute force breach of Salesforce itself, but the clever compromise of the trusted link between a popular third-party application and the CRM giant. This incident reinforces that Salesforce security is inextricably linked to the security hygiene of its entire partner ecosystem and the management of complex OAuth permissions. The forced token revocation and AppExchange removal underscore the severity.

The key takeaways are stark:

1. OAuth tokens are crown jewels: Their compromise provides direct, authorized access – treat them with extreme care.
2. Third-party integrations demand scrutiny: Conduct rigorous security assessments of any app connecting to core systems like Salesforce.
3. Secrets management is non-negotiable: Never store sensitive cloud credentials within CRM or other SaaS platforms.
4. Least privilege is paramount: Grant integrations the bare minimum access permissions needed.
5. Security is a shared responsibility: SaaS providers (Salesforce, Salesloft), the app developers, and the end-customer all play vital roles.

As SaaS environments become increasingly interconnected, the lessons from this breach are universal. Vigilance must extend far beyond an organization’s own perimeter, deeply into the security posture of the platforms and partners it trusts. Proactive auditing, least privilege enforcement, and immediate response to credential compromise are no longer optional. What steps is your organization taking to secure its critical SaaS integrations and OAuth tokens? Share your strategies in the comments below.

Sources & Further Reading:
Original article at go.theregister.com