Chaos Mesh Vulnerabilities: How GraphQL Flaws Enable Cyber Attacks

FBI Warns of UNC6040 and UNC6395: Urgent Security Threats to Salesforce Platforms

Update FBI Sounds Alarm on UNC6040 and UNC6395 Data TheftThe FBI recently heightened awareness about two cybercriminal groups, UNC6040 and UNC6395, embarking on extensive data theft and extortion attacks against various organizations leveraging Salesforce platforms. The alert outlines significant IoCs (Indicators of Compromise) that security teams need to monitor closely.Understanding the Threat LandscapeUNC6395 has been particularly active, conducting a wide-ranging data theft campaign focused on exploiting Salesforce instances. They managed to compromise OAuth tokens through Salesloft's Drift application, which was the result of a breach of Salesloft's GitHub account. In response, Salesloft quickly isolated the Drift infrastructure, implementing new multi-factor authentication and improving their security configurations to prevent further issues.The Tactics and Techniques UsedMeanwhile, UNC6040 has demonstrated a more sophisticated approach to data exfiltration. Engaging in vishing campaigns, they trick victims into providing access to Salesforce instances for large-scale data theft. Utilizing a modified version of Salesforce's Data Loader and custom Python scripts, they execute API queries that allow for the bulk exfiltration of valuable data. This phase often leads to threats of extortion, which have been identified in previous incidents.Emerging Threats and CollaborationsAs pressures mount from these attacks, there seems to be a new escalation in criminal tactics. The association of groups like ShinyHunters with others like Scattered Spider and LAPSUS$ is alarming, showcasing a potential unification of efforts that could increase their proficiency and risk to organizations.Best Practices for ProtectionGiven the fragility of current corporate cybersecurity setups, it’s paramount for organizations to employ stringent security measures including rotating credentials and periodically auditing application infrastructures. Information security health checks and enhancing authentication protocols can serve as vital bulwarks against such attacks.ConclusionThe landscape of cybersecurity is rapidly evolving as destructive tactics become more sophisticated. Organizations must stay abreast of these developments by implementing robust security measures to safeguard sensitive data from adversarial threats. As these groups continuously adapt, vigilance is crucial.