Search/ShinyHunters Wage Broad Corporate Extortion Spree
● Story

ShinyHunters Wage Broad Corporate Extortion Spree

An extortion group has launched a new data leak site to publicly extort dozens of companies impacted by a wave of Salesforce breaches, leaking samples of data stolen in the attacks. The threat actors responsible for these attacks claim to be part of the ShinyHunters, Scattered Spider, and Lapsus$ groups, collectively referring to themselves as "Scattered Lapsus$ Hunters." Today, they launched a new data leak site containing 39 companies impacted by the attacks. Each entry includes samples of data allegedly stolen from victims' Salesforce instances, and warns the victims to reach out to "prevent public disclosure" of their data before the October 10 deadline is reached. The companies being extorted on the data leak site include well-known brands and organizations, including FedEx,…

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
8
Connections
39 relationships
Exploitation of Oracle EBS Zero-Day Started 2 Months Before Patching
More information has come to light on the recently patched Oracle E-Business Suite (EBS) zero-day, with evidence indicating that threat actors knew about the vulnerability for at least two months before it was patched. Google Threat Intelligence Group (GTIG) and Mandiant first warned about attacks aimed at Oracle E-Business Suite on October 2, after executives at many organizations received extortion emails from the Cl0p cybercrime group. It has since been confirmed that Cl0p was behind the attacks, and that the cybercriminals likely managed to steal large amounts of data from the EBS instances of targeted organizations since August. Oracle initially said the attacks appeared to involve exploitation of unspecified vulnerabilities patched in July, but the software giant confirmed on October 4 that a zero-day flaw has also been exploited. The zero-day, tracked as CVE-2025-61882 with a CVSS score of 9.8, impacts the BI Publisher Integration component of Oracle Concurrent Processing. It can be exploited by an unauthenticated attacker for remote code execution. CrowdStrike has been monitoring the attacks involving CVE-2025-61882 and has tied them with moderate confidence to a Russia-linked threat actor it tracks as Graceful Spider, which is known for conducting attacks with the Cl0p ransomware. However, the cybersecurity firm says it’s possible that multiple groups have exploited the zero-day. While CrowdStrike’s investigation is ongoing, the information it has collected to date indicates that the zero-day was first exploited on August 9. The hacker groups ShinyHunters and Scattered Spider (now calling themselves Scattered LAPSUS$ Hunters as a result of a collaboration) have published a proof-of-concept (PoC) exploit for CVE-2025-61882. While it initially appeared that Scattered LAPSUS$ Hunters may have been collaborating with the Cl0p hackers, a message in one of the files published alongside the exploits suggests a feud between the threat groups. Indicators of compromise (IoCs) published by Oracle suggested that the leaked PoC was real, which has been confirmed by an analysis of the PoC conducted by security firm WatchTowr. “The [exploit] chain demonstrates a high level of skill and effort, with at least five distinct bugs orchestrated together to achieve pre-authenticated Remote Code Execution,” WatchTowr said. With the PoC now public, the cybersecurity industry expects other threat actors to add CVE-2025-61882 to their arsenal and they may still have plenty of targets to choose from. Censys reported seeing over 2,000 internet-exposed instances of Oracle E-Business Suite. The Shadowserver Foundation has identified over 570 potentially vulnerable instances. Both Censys and Shadowserver saw the highest number of EBS instances in the United States, followed at a distance by China. Related: Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks Related: Critical Vulnerability Puts 60,000 Redis Servers at Risk of Exploitation
securityweek.comOct 8, 2025extracted
Salesforce refuses to pay ransom over widespread data theft attacks
Salesforce has confirmed that it will not negotiate with or pay a ransom to the threat actors behind a massive wave of data theft attacks that impacted the company's customers this year. As first reported by Bloomberg, Salesforce emailed customers on Tuesday to say they would not be paying a ransom and warned that "credible threat intelligence" indicates the threat actors were planning to leak the stolen data. "I can confirm Salesforce will not engage, negotiate with, or pay any extortion demand," Salesforce also confirmed to BleepingComputer. This statement follows the launch of a data leak site by threat actors known as "Scattered Lapsus$ Hunters," who are attempting to extort 39 companies whose data was stolen from Salesforce. The website was located on the breachforums[.]hn domain, which is named after the notorious BreachForums website, a hacking forum known for selling and leaking stolen data. The companies being extorted on the data leak site included well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, Kering, McDonald's, Walgreens, Instacart, Cartier, Adidas, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. In total, the threat actors claimed to have stolen nearly 1 billion data records, which would be publicly released if an extortion demand was paid by individual companies or as a single payment from Salesforce that would cover all the impacted customers listed on the site. This data was stolen from Salesforce instances in two separate campaigns that occurred in 2025. The first data theft campaign began at the end of 2024, when threat actors started conducting social engineering attacks impersonating IT support staff to trick employees into connecting a malicious OAuth application to their company's Salesforce instance. Once linked, the threat actors used the connection to download and steal the databases, which were then used to extort the company through email. These social engineering attacks impacted Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, Kering, and LVMH subsidiaries, such as Dior, Louis Vuitton, and Tiffany & Co. A second Salesforce data-theft campaign began in early August 2025, when the threat actors used stolen SalesLoft Drift OAuth tokens to pivot to customers' CRM environments and exfiltrate data. The Salesloft data-theft attacks primarily focused on stealing support ticket data to scan for credentials, API tokens, authentication tokens, and other sensitive information that would enable the attackers to breach the company's infrastructure and cloud services. One of the threat actors behind the Salesloft attacks, known as ShinyHunters, told BleepingComputer that they stole approximately 1.5 billion data records for over 760 companies during this campaign. Many companies have already confirmed they were impacted by the Salesloft supply-chain attack, including Google, Cloudflare, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Nutanix, Qualys, Rubrik, Cato Networks, Palo Alto Networks, and many more. The recently launched data leak site was used primarily to extort customers in the original social engineering attacks, with the threat actors stating they would begin publicly extorting those impacted by the Salesloft attacks after October 10th. However, the data leak site is now shut down, with the domain now using nameservers of surina.ns.cloudflare.com and hans.ns.cloudflare.com, which have both been used by the FBI in the past when seizing domains. BleepingComputer contacted the FBI about whether they seized the domain but has not received a response at this time. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comOct 8, 2025extracted
ShinyHunters Wage Broad Corporate Extortion Spree
A cybercriminal group that used voice phishing attacks to siphon more than a billion records from Salesforce customers earlier this year has launched a website that threatens to publish data stolen from dozens of Fortune 500 firms if they refuse to pay a ransom. The group also claimed responsibility for a recent breach involving Discord user data, and for stealing terabytes of sensitive files from thousands of customers of the enterprise software maker Red Hat. In May 2025, a prolific and amorphous English-speaking cybercrime group known as ShinyHunters launched a social engineering campaign that used voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The first real details about the incident came in early June, when the Google Threat Intelligence Group (GTIG) warned that ShinyHunters — tracked by Google as UNC6040 — was extorting victims over their stolen Salesforce data, and that the group was poised to launch a data leak site to publicly shame victim companies into paying a ransom to keep their records private. A month later, Google acknowledged that one of its own corporate Salesforce instances was impacted in the voice phishing campaign. Last week, a new victim shaming blog dubbed “Scattered LAPSUS$ Hunters” began publishing the names of companies that had customer Salesforce data stolen as a result of the May voice phishing campaign. “Contact us to negotiate this ransom or all your customers data will be leaked,” the website stated in a message to Salesforce. “If we come to a resolution all individual extortions against your customers will be withdrawn from. Nobody else will have to pay us, if you pay, Salesforce, Inc.” Below that message were more than three dozen entries for companies that allegedly had Salesforce data stolen, including Toyota, FedEx, Disney/Hulu, and UPS. The entries for each company specified the volume of stolen data available, as well as the date that the information was retrieved (the stated breach dates range between May and September 2025). On October 5, the Scattered LAPSUS$ Hunters victim shaming and extortion blog announced that the group was responsible for a breach in September involving a GitLab server used by Red Hat that contained more than 28,000 Git code repositories, including more than 5,000 Customer Engagement Reports (CERs). “Alot of folders have their client’s secrets such as artifactory access tokens, git tokens, azure, docker (redhat docker, azure containers, dockerhub), their client’s infrastructure details in the CERs like the audits that were done for them, and a whole LOT more, etc.,” the hackers claimed. Their claims came several days after a previously unknown hacker group calling itself the Crimson Collective took credit for the Red Hat intrusion on Telegram. Red Hat disclosed on October 2 that attackers had compromised a company GitLab server, and said it was in the process of notifying affected customers. “The compromised GitLab instance housed consulting engagement data, which may include, for example, Red Hat’s project specifications, example code snippets, internal communications about consulting services, and limited forms of business contact information,” Red Hat wrote. Separately, Discord has started emailing users affected by another breach claimed by ShinyHunters. Discord said an incident on September 20 at a “third-party customer service provider” impacted a “limited number of users” who communicated with Discord customer support or Trust & Safety teams. The information included Discord usernames, emails, IP address, the last four digits of any stored payment cards, and government ID images submitted during age verification appeals. The Scattered Lapsus$ Hunters claim they will publish data stolen from Salesforce and its customers if ransom demands aren’t paid by October 10. The group also claims it will soon begin extorting hundreds more organizations that lost data in August after a cybercrime group stole vast amounts of authentication tokens from Salesloft, whose AI chatbot is used by many corporate websites to convert customer interaction into Salesforce leads. In a communication sent to customers today, Salesforce emphasized that the theft of any third-party Salesloft data allegedly stolen by ShinyHunters did not originate from a vulnerability within the core Salesforce platform. The company also stressed that it has no plans to meet any extortion demands. “Salesforce will not engage, negotiate with, or pay any extortion demand,” the message to customers read. “Our focus is, and remains, on defending our environment, conducting thorough forensic analysis, supporting our customers, and working with law enforcement and regulatory authorities.” The GTIG tracked the group behind the Salesloft data thefts as UNC6395, and says the group has been observed harvesting the data for authentication tokens tied to a range of cloud services like Snowflake and Amazon’s AWS. Google catalogs Scattered Lapsus$ Hunters by so many UNC names (throw in UNC6240 for good measure) because it is thought to be an amalgamation of three hacking groups — Scattered Spider, Lapsus$ and ShinyHunters. The members of these groups hail from many of the same chat channels on the Com, a mostly English-language cybercriminal community that operates across an ocean of Telegram and Discord servers. The Scattered Lapsus$ Hunters darknet blog is currently offline. The outage appears to have coincided with the disappearance of the group’s new clearnet blog — breachforums[.]hn — which vanished after shifting its Domain Name Service (DNS) servers from DDoS-Guard to Cloudflare. But before it died, the websites disclosed that hackers were exploiting a critical zero-day vulnerability in Oracle’s E-Business Suite software. Oracle has since confirmed that a security flaw tracked as CVE-2025-61882 allows attackers to perform unauthenticated remote code execution, and is urging customers to apply an emergency update to address the weakness. Mandiant’s Charles Carmakal shared on LinkedIn that CVE-2025-61882 was initially exploited in August 2025 by the Clop ransomware gang to steal data from Oracle E-Business Suite servers. Bleeping Computer writes that news of the Oracle zero-day first surfaced on the Scattered Lapsus$ Hunters blog, which published a pair of scripts that were used to exploit vulnerable Oracle E-Business Suite instances. On Monday evening, KrebsOnSecurity received a malware-laced message from a reader that threatened physical violence unless their unstated demands were met. The missive, titled “Shiny hunters,” contained the hashtag $LAPSU$$SCATEREDHUNTER, and urged me to visit a page on limewire[.]com to view their demands. KrebsOnSecurity did not visit this link, but instead forwarded it to Mandiant, which confirmed that similar menacing missives were sent to employees at Mandiant and other security firms around the same time. The link in the message fetches a malicious trojan disguised as a Windows screensaver file (Virustotal’s analysis on this malware is here). Simply viewing the booby-trapped screensaver on a Windows PC is enough to cause the bundled trojan to launch in the background. Mandiant’s Austin Larsen said the trojan is a commercially available backdoor known as ASYNCRAT, a .NET-based backdoor that communicates using a custom binary protocol over TCP, and can execute shell commands and download plugins to extend its features. “Downloaded plugins may be executed directly in memory or stored in the registry,” Larsen wrote in an analysis shared via email. “Capabilities added via plugins include screenshot capture, file transfer, keylogging, video capture, and cryptocurrency mining. ASYNCRAT also supports a plugin that targets credentials stored by Firefox and Chromium-based web browsers.” Malware-laced targeted emails are not out of character for certain members of the Scattered Lapsus$ Hunters, who have previously harassed and threatened security researchers and even law enforcement officials who are investigating and warning about the extent of their attacks. With so many big data breaches and ransom attacks now coming from cybercrime groups operating on the Com, law enforcement agencies on both sides of the pond are under increasing pressure to apprehend the criminal hackers involved. In late September, prosecutors in the U.K. charged two alleged Scattered Spider members aged 18 and 19 with extorting at least $115 million in ransom payments from companies victimized by data theft. U.S. prosecutors heaped their own charges on the 19 year-old in that duo — U.K. resident Thalha Jubair — who is alleged to have been involved in data ransom attacks against Marks & Spencer and Harrods, the British food retailer Co-op Group, and the 2023 intrusions at MGM Resorts and Caesars Entertainment. Jubair also was allegedly a key member of LAPSUS$, a cybercrime group that broke into dozens of technology companies beginning in late 2021. In August, convicted Scattered Spider member and 20-year-old Florida man Noah Michael Urban was sentenced to 10 years in federal prison and ordered to pay roughly $13 million in restitution to victims. In April 2025, a 23-year-old Scottish man thought to be an early Scattered Spider member was extradited from Spain to the U.S., where he is facing charges of wire fraud, conspiracy and identity theft. U.S. prosecutors allege Tyler Robert Buchanan and co-conspirators hacked into dozens of companies in the United States and abroad, and that he personally controlled more than $26 million stolen from victims. Update, Oct. 8, 8:59 a.m. ET: A previous version of this story incorrectly referred to the malware sent by the reader as a Windows screenshot file. Rather, it is a Windows screensaver file.
krebsonsecurity.comOct 7, 2025extracted
Red Hat data breach escalates as ShinyHunters joins extortion
Enterprise software giant Red Hat is now being extorted by the ShinyHunters gang, with samples of stolen customer engagement reports (CERs) leaked on their data leak site. News of the Red Hat data breach broke last week when a hacking group known as the Crimson Collective claimed to have stolen nearly 570GB of compressed data across 28,000 internal development repositories. This data allegedly includes approximately 800 Customer Engagement Reports (CERs), which can contain sensitive information about a customer's network, infrastructure, and platforms. The threat actors claimed to have attempted to extort Red Hat into paying a ransom to prevent the public disclosure of the data, but received no response. Red Hat later confirmed to BleepingComputer that the breach affected its GitLab instance, which was used solely for Red Hat Consulting on consulting engagements. Soon after the breach was disclosed, threat actors known as Scattered Lapsus$ Hunters sought to make contact with Crimson Collective. Yesterday, Crimson Collective announced that it had partnered with Scattered Lapsus$ Hunters to utilize the newly launched ShinyHunters data leak site to continue their extortion attempts against Red Hat. "On the 4th April 1949 was created the so big called NATO, but what if today's new alliance was bigger than that ? But for a greater purpose, ruining corporations mind," reads a post to the hacking group's Telegram channel. "What if, Crimson's shininess extends even further away ?" "Regarding the current announcement regarding us, we are going to collaborate with ShinyHunter's for the future attacks and releases," the Crimson Collective threat actors told BleepingComputer. In coordination with the announcement, a Red Hat entry has now appeared on a new ShinyHunters data leak extortion site, warning the company that data would be publicly leaked on October 10th if a ransom demand was not negotiated with ShinyHunters. In addition, the threat actors released samples of the stolen CERs, including those for Walmart, HSBC, Bank of Canada, Atos Group, American Express, Department of Defence, and Société Française du Radiotéléphone. BleepingComputer contacted Red Hat about this development but did not receive a response. The ShinyHunters Extortion-as-a-Service For months, BleepingComputer has speculated that ShinyHunters was acting as an extortion-as-a-service (EaaS), where they work with threat actors to extort a company in exchange for a share of the extortion demand, similar to how ransomware-as-a-service gangs operate. This theory was based on the numerous attacks conducted by various threat actors, all of which were extorted under the ShinyHunters name, including those targeting Oracle Cloud and PowerSchool. Conversations with ShinyHunters further supported this theory, as the group has previously claimed not to be behind a particular breach but rather just acting as a broker of the stolen data. Furthermore, there have been numerous arrests of individuals associated with the name "ShinyHunters" over the years, including those linked to the Snowflake data theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum. However, even after these arrests, new attacks occur with companies receiving extortion emails stating, "We are ShinyHunters". Today, ShinyHunters told BleepingComputer that they have been privately operating as an EaaS, where they take a revenue share from any extortion payments generated for other threat actors' attacks. "Everyone i've worked with in the past have taken 70 or 75% and I receive a 25-30%," claimed the threat actor. With the launch of the ShinyHunters data leak site, it appears that the threat actor is now publicly operating the extortion service. In addition to Red Hat, ShinyHunters is also extorting SP Global on behalf of another threat actor that claimed to breach the company in February 2025. BleepingComputer had contacted SP Global at the time about the alleged breach, but was told that the claims were false and that the company was not breached. However, the threat actors have now released samples of data on the data leak site, claiming they were stolen during the attack, and have also set an October 10th deadline. After contacting SP Global again today regarding its inclusion on the data leak site, they decided not to comment on the claims. "We don't comment on such claims. We note that as a US listed company, we are required to publicly disclose material cybersecurity incidents," SP Global told BleepingComputer. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comOct 6, 2025extracted
Hackers launch data leak site to extort 39 victims, or Salesforce
Hackers launch data leak site to extort 39 victims, or Salesforce Scattered Lapsus$ Hunters launched a data leak site over the weekend, aiming to pressure organizations whose Salesforce databases they have plundered into paying to prevent the stolen data from being released. Screenshot of Scattered Lapsus$ Hunters data leak site (Source: Help Net Security) The group’s victims Scattered Lapsus$ Hunters is a hacker collective that reportedly brings together members of the Scattered Spider, Lapsus$, and ShinyHunters cybercrime groups. The dark web data leak site currently lists 39 companies whose data was apparently stolen by compromising their corporate Salesforce instances via social engineering: Toyota, FedEx, Disney/Hulu, Republic Services, UPS, AeroMexico, Home Depot, Marriott, Vietnam Airlines, Walgreens, Stellantis, McDonald’s, KFC, ASICS, GAP, MHM, Fujifilm, Instructure.com – Canvas, Albertsons, Engie Resources, Kering (Gucci, Balenciaga, Brioni, AlexanderMcQ), HBO Max, Instacart, Petco, Puma, Cartier, Adidas, TripleA, Qantas Airways, CarMax, Saks Fifth (Avenue), 1-800Accountant, AirFrance & KLM, Google Adsense, Cisco, Pandora, TransUnion, Chanel, and IKEA. Each entry lists the date when the breach happened, the type and amount of data stolen, and provides a link to a sample of the data. The stated breach dates span from April 2024 to September 2025, and most of the stolen data includes personal and contact information of the victim organizations’ customers, employees, and/or partners. In specific instances, the data also encompasses account IDs, dates of birth, passport numbers, Social Security numbers, purchases, live chat transcripts, and more. As Dissent Doe over at DataBreaches.net noted, customer data can be used for phishing or other social engineering attacks, and data about expensive purchases could be used by fraudsters to compile a list of preferred targets. “Even worse, perhaps: some seemingly benign data can also put named individuals at risk of political violence or targeting. In this type of situation, DataBreaches includes the Home Depot incident, because Home Depot has a file devoted to government employees that includes their names, email and postal addresses, and phone numbers,” Doe pointed out. The group’s demands Scattered Lapsus$ Hunters has given the companies until October 10, 2025, to contact them (via corporate email) and to begin negotiating the ransom. The same deadline has been given to Salesforce and, if the company plays ball, Scattered Lapsus$ Hunters will purportedly not go after the 39 affected companies. The group threatened to comply “with the many law firms that are pursuing civil and commercial litigation against [Salesforce]” and release documentation that ostensibly shows that the company “made little to no attempt to prevent unauthorised access to PII.” After the data leak site went public, Salesforce pushed out a security advisory stating that they are aware of recent extortion attempts by threat actors, which they have investigated in partnership with external experts and authorities. “Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology,” the company stated. Customers have been advised to remain vigilant against phishing and social engineering attempts and to reach out through the Salesforce Help portal for support, if needed. What else? The data leaks site also contains three listings unrelated to the breaches under the “Salesforce customers” heading: Credit Institute of Vietnam, S&P Global, and Red Hat. The latter breach is the most recent and has been claimed by the Crimson Collective. (The relationship between the Crimson Collective and Scattered Lapsus$ Hunters is currently unknown.) Scattered Lapsus$ Hunters has also stated on Telegram that, by the end of the week, they will start extorting companies whose data they exfiltrated by leveraging OAuth credentials stolen from Salesloft / Drift. UPDATE (October 8, 2025, 09:40 a.m. ET): Salesforce “will not engage, negotiate with, or pay any extortion demand,” a spokesperson for the company confirmed. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
helpnetsecurity.comOct 6, 2025extracted
ShinyHunters launches Salesforce data leak site to extort 39 victims
An extortion group has launched a new data leak site to publicly extort dozens of companies impacted by a wave of Salesforce breaches, leaking samples of data stolen in the attacks. The threat actors responsible for these attacks claim to be part of the ShinyHunters, Scattered Spider, and Lapsus$ groups, collectively referring to themselves as "Scattered Lapsus$ Hunters." Today, they launched a new data leak site containing 39 companies impacted by the attacks. Each entry includes samples of data allegedly stolen from victims' Salesforce instances, and warns the victims to reach out to "prevent public disclosure" of their data before the October 10 deadline is reached. The companies being extorted on the data leak site include well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, Instacart, Cartier, Adidas, CarMax, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. "All of them have been contacted long ago, they saw the email because I saw them download the samples multiple times. Most of them chose to not disclose and ignore," ShinyHunters told BleepingComputer. "We highly advise you proceed into the right decision, your organisation can prevent the release of this data, regain control over the situation and all operations remain stable as always. We highly recommend a decision-maker to get involved as we are presenting a clear and mutually beneficial opportunity to resolve this matter," they warned on the leak site. The threat actors also added a separate entry requesting that Salesforce pay a ransom to prevent all impacted customers' data (approximately 1 billion records containing personal information) from being leaked. "Should you comply, we will withdraw from any active or pending negotiation indiviually from your customers. Your customers will not be attacked again nor will they face a ransom from us again, should you pay," they added. The extortion group also threatened the company, stating that it would help law firms pursue civil and commercial lawsuits against Salesforce following the data breaches and warned that the company had also failed to protect customers' data as required by the European General Data Protection Regulation (GDPR). Scattered Lapsus$ Hunters have been targeting Salesforce customers with voice phishing attacks since the beginning of the year, leading to breaches that have impacted companies such as Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, as well as LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. In these attacks, the threat actors tricked employees into linking a malicious OAuth app to their company's Salesforce instance. ShinyHunters told BleepingComputer that while a particular Salesforce instance may have been targeted, it also contained data for many of the subsidiaries, making the attacks more impactful. Once connected, the attackers stole company databases and used the data to extort victims via email. These extortion emails were signed by ShinyHunters, a notorious extortion group linked to a long string of high-profile breaches in recent years, including the Snowflake attacks and those against AT&T and PowerSchool. ShinyHuntersalso claimed to have used stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to steal sensitive information, including passwords, AWS access keys, and Snowflake tokens, from customers' Salesforce instances. These attacks were tracked by Mandiant under a separate threat cluster named "UNC6395" as they have been unable to formally link the breaches to this group. On a Telegram channel associated with the extortion group, the threat actors claim that they will begin extorting companies affected by the Salesloft Drift attacks on a separate data leak site launching on October 10th. The Salesloft attacks are known to have impacted Google, Palo Alto Networks, CyberArk, Cloudflare, Rubrik, Elastic, BeyondTrust, Proofpoint, JFrog, Zscaler, Tenable, Nutanix, Qualys, and Cato Networks, among many others. ShinyHunters claim that companies will not be re-extorted under the Salesloft campaign if a ransom is paid in this initial extortion phase. "We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support," Salesforce said in a statement published after ShinyHunters launched their data leak site. "At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology." Update October 03, 11:02 EDT: Added Salesforce statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comOct 3, 2025extracted
Your Service Desk is the New Attack Vector—Here's How to Defend It.
The service desk is the new perimeter Attackers aren’t picking locks—they’re picking people. The fastest way inside many enterprises is still the service desk. Threat actors like Scattered Spider have turned social engineering into a science, and your help desk agents are their primary target. One convincing phone call can turn a routine password reset into full domain access. The MGM Resorts and Clorox incidents showed how devastating one successful social-engineering call can be, with a nine-figure business impact and weeks of disruption. That’s not a fluke; it’s the playbook. Training Helps, Controls Decide Yes, agent training matters. No, it won’t save you on its own. Social engineers are specialists at exploiting helpful humans under time pressure. Scripts, “common sense,” and ad-hoc challenge questions break down when an attacker is calm, prepared, and persuasive. If your last line of defense is an overworked agent making a judgment call, you’ve already lost. Bottom line: user verification must be a security-owned workflow, not an agent-owned conversation. See how to design role-based, points-based verification that fits your ServiceNow flow and stops social engineering without slowing support. Download our comprehensive guide and start building a more resilient help desk today See the Guide A workflow approach to help desk user verification Shift verification out of the agent’s head and into a formal IT-security workflow that’s consistent, logged, and enforced: Mandatory controls: Agents never handle or view credentials. The workflow does. Role-based verification: Align the depth of checks to the risk of the persona (execs, admins, finance, contractors, etc.). High-risk roles demand stronger proofs. Points-based flexibility: Real life happens—phones die, travel breaks MFA. Use multiple proof types with scores that add up to a pass/fail threshold. ITSM integration: Keep the agent in their normal tool (e.g., ServiceNow). Tickets launch the verification flow automatically and return the result + telemetry back to the ticket. Reduce Agent Stress and Error: A formal workflow removes the burden of being a security expert from your agents. They no longer have to make high-stakes judgment calls, leading to faster, more consistent, and less stressful ticket handling. This isn't just better security; it's better service. What “good” looks like (NIST-aligned profiles) Most of our customers start with three verification profiles mapped to user risk and available factors. It could be like this: Profile 1 (Standard User - Low Assurance): For routine requests like a password reset for a standard employee. - Method: A push notification to their registered corporate authenticator app (Okta Verify, MS Authenticator). This is fast, familiar, and leverages existing infrastructure. Profile 2 (Privileged User / Sensitive Action - High Assurance): For domain admins, finance controllers, or anyone requesting a sensitive change. - Method: Requires two distinct factors. For example: Successful authenticator push notification AND a one-time code sent to the corporate email address on file. OR answering a question based on a non-public attribute from the HRIS system (e.g., "What is your employee ID number?"). Method: Requires two distinct factors. For example: Successful authenticator push notification Profile 3 (Contingency / MFA Failure - Flexible Assurance): For when the user has lost their primary MFA device. - Method: The user must achieve 100 points from a menu of options, preventing them from being fully locked out. - One-time code to personal email on file: (50 points) - One-time code to personal phone number on file: (50 points) - Verification of device serial number from MDM: (60 points) - answering a question based on a non-public attribute from the HRIS system (e.g., "What is your employee ID number?"). (50 points) Method: The user must achieve 100 points from a menu of options, preventing them from being fully locked out. Tip: If MFA isn’t universally available, prefer enterprise-verified data (HRIS/IDP attributes, device posture, geo/behavior signals) over guessable personal trivia. Keep a short, vetted list and retire any question that leaks or shows up in breaches. Detect attacks early, document everything When verification lives inside the workflow, you get security outcomes “for free”. These are some of the extra benefits realized by our customers: Early warning: Spikes in failed verifications against the same user or role are smoke before fire—auto-alert SecOps. Automatic warning against suspicious accounts, same user calling in short time. Audit trail: Every attempt, factor, score, and outcome is stamped back onto the ticket. Compliance: Automated reporting demonstrates consistent controls across the desk. Rollout plan that won’t break the desk All organizations have their own project principles but these are common traits: Inventory factors + gaps: Which users have MFA? Which don’t? What secure data is suitable for knowledge checks? Define 3 profiles: Map to low/medium/high-risk roles; set pass threshold to 100. Integrate with ITSM: Trigger the flow from your ticket (e.g., ServiceNow) with user ID + category; write back results and telemetry. Train for process, not persuasion: Agents learn one thing—follow the workflow. Measure and tune: Track failure rates, time-to-resolution, escalations, and false rejects. Adjust scoring and questions quarterly. A note on our tools FastPass Identity Verification Manager (IVM) implements this model: mandatory, role-based, and points-based verification, tightly integrated with ITSM. It centralizes checks, enforces policy, and returns results + context to the ticket for alerting, audit, and compliance. If you’re facing Scattered Spider-style tactics, this is the kind of guardrail that blocks them at the first hop. FastPassCorp has assisted several large organizations with implementation of secure user workflow, and has gained a superior experience in the field documented in the available guides and videos. The takeaway You don’t beat social engineering with nicer posters and longer scripts. You beat it by removing discretion, raising proof, and instrumenting the workflow the attacker is trying to exploit. Do that, and the service desk stops being a soft target and starts acting like a proper control. Concerned about Scattered Spider? If you’d like to know how you can protect your service desk and agents against a Scattered Spider or other social engineering attack? Have a look at our videos and guides for implementing a secure user verification workflow or contact us for a meeting on your situation. Sponsored and written by FastPassCorp.
bleepingcomputer.comOct 2, 2025extracted
1.5 Million Impacted by Allianz Life Data Breach
Insurance giant Allianz subsidiary Allianz Life Insurance Company of North America is notifying roughly 1.5 million people that their personal information was stolen in a July data breach. The incident occurred on July 16 and involved a third-party cloud-based customer relationship management (CRM) system used by Allianz Life, the company told SecurityWeek in July. Only Allianz Life in the US was impacted, the company said, adding that most of its roughly 1.4 million customers were likely affected, without sharing an exact number. This week, however, the company notified the Maine Attorney General’s Office that the breach affects the data of 1,497,036 “Allianz Life customers, financial professionals, and select Allianz Life employees”. The stolen personal information includes names, addresses, dates of birth, and Social Security numbers, the insurer notes in the notification letter sent to the affected people. Allianz Life is providing the affected individuals with two years of free identity theft restoration and credit monitoring services. The company also said it has contained and mitigated the issue, and that the incident was limited to the third-party CRM, as none of its systems were accessed. While Allianz Life did not share details on the compromised CRM, the attack was attributed to the infamous Scattered Spider cybercrime group, which conducted a large-scale campaign targeting the Salesforce instances of major companies. Adidas, Cisco, Dior, Louis Vuitton, Google, Air France/KLM, and Workday are also believed to have been targeted in the campaign. Scattered Spider and its recent partner-in-crime ShinyHunters, a hacking group specializing in extortion, announced in mid-September their retirement, but cybersecurity specialists remain skeptical of their disappearance from the threat landscape. Related: Canadian Airline WestJet Says Hackers Stole Customer Data Related: Automotive Titan Stellantis Discloses Data Breach Related: Salesforce AI Hack Enabled CRM Data Theft Related: 33 Attorneys General Send Letter to FTC on Commercial Surveillance Rules
securityweek.comOct 2, 2025extracted
Related Stories
6
ShinyHunters launches Salesforce data leak site to extort 39 victims
An extortion group has launched a new data leak site to publicly extort dozens of companies impacted by a wave of Salesforce breaches, leaking samples of data stolen in the attacks. The threat actors responsible for these attacks claim to be part of the ShinyHunters, Scattered Spider, and Lapsus$ groups, collectively referring to themselves as "Scattered Lapsus$ Hunters." Today, they launched a new data leak site containing 39 companies impacted by the attacks. Each entry includes samples of data allegedly stolen from victims' Salesforce instances, and warns the victims to reach out to "prevent public disclosure" of their data before the October 10 deadline is reached. The companies being extorted on the data leak site include well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, Instacart, Cartier, Adidas, CarMax, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. "All of them have been contacted long ago, they saw the email because I saw them download the samples multiple times. Most of them chose to not disclose and ignore," ShinyHunters told BleepingComputer. "We highly advise you proceed into the right decision, your organisation can prevent the release of this data, regain control over the situation and all operations remain stable as always. We highly recommend a decision-maker to get involved as we are presenting a clear and mutually beneficial opportunity to resolve this matter," they warned on the leak site. The threat actors also added a separate entry requesting that Salesforce pay a ransom to prevent all impacted customers' data (approximately 1 billion records containing personal information) from being leaked. "Should you comply, we will withdraw from any active or pending negotiation indiviually from your customers. Your customers will not be attacked again nor will they face a ransom from us again, should you pay," they added. The extortion group also threatened the company, stating that it would help law firms pursue civil and commercial lawsuits against Salesforce following the data breaches and warned that the company had also failed to protect customers' data as required by the European General Data Protection Regulation (GDPR). Scattered Lapsus$ Hunters have been targeting Salesforce customers with voice phishing attacks since the beginning of the year, leading to breaches that have impacted companies such as Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, as well as LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. In these attacks, the threat actors tricked employees into linking a malicious OAuth app to their company's Salesforce instance. ShinyHunters told BleepingComputer that while a particular Salesforce instance may have been targeted, it also contained data for many of the subsidiaries, making the attacks more impactful. Once connected, the attackers stole company databases and used the data to extort victims via email. These extortion emails were signed by ShinyHunters, a notorious extortion group linked to a long string of high-profile breaches in recent years, including the Snowflake attacks and those against AT&T and PowerSchool. ShinyHuntersalso claimed to have used stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to steal sensitive information, including passwords, AWS access keys, and Snowflake tokens, from customers' Salesforce instances. These attacks were tracked by Mandiant under a separate threat cluster named "UNC6395" as they have been unable to formally link the breaches to this group. On a Telegram channel associated with the extortion group, the threat actors claim that they will begin extorting companies affected by the Salesloft Drift attacks on a separate data leak site launching on October 10th. The Salesloft attacks are known to have impacted Google, Palo Alto Networks, CyberArk, Cloudflare, Rubrik, Elastic, BeyondTrust, Proofpoint, JFrog, Zscaler, Tenable, Nutanix, Qualys, and Cato Networks, among many others. ShinyHunters claim that companies will not be re-extorted under the Salesloft campaign if a ransom is paid in this initial extortion phase. "We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support," Salesforce said in a statement published after ShinyHunters launched their data leak site. "At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology." Update October 03, 11:02 EDT: Added Salesforce statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
25 shared
Oct 3, 2025
Scattered Spider gang feigns retirement, breaks into bank instead
FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
17 shared
Sep 17, 2025
Two Scattered Spider Suspects Arrested in UK; One Charged in US
FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
17 shared
Sep 23, 2025
Analyzing Sharepoint Exploits (CVE-2025-53770, CVE-2025-53771), (Wed, Jul 23rd)
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*
11 shared
Jul 28, 2025
Scattered Spider Related Domain Names, (Thu, Jul 31st)
A wave of data breaches impacting companies like Qantas, Allianz Life, LVMH, and Adidas has been linked to the ShinyHunters extortion group, which has been using voice phishing attacks to steal data from Salesforce CRM instances. In June, Google's Threat Intelligence Group (GTIG) warned that threat actors tracked as UNC6040 were targeting Salesforce customers in social engineering attacks. In these attacks, the threat actors impersonated IT support staff in phone calls to targeted employees, attempting to persuade them into visiting Salesforce's connected app setup page. On this page, they were told to enter a "connection code", which linked a malicious version of Salesforce's Data Loader OAuth app to the target's Salesforce environment. In some cases, the Data Loader component was renamed to "My Ticket Portal," to make it more convincing in the attacks. GTIG says that these attacks were usually conducted through vishing (voice phishing), but credentials and MFA tokens were also stolen through phishing pages that impersonated Okta login pages. Around the time of this report, multiple companies reported data breaches involving third-party customer service or cloud-based CRM systems. LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. each disclosed unauthorized access to a customer information database, with Tiffany Korea notifying customers the attackers breached a "vendor platform used for managing customer data." Adidas, Qantas, and Allianz Life also reported breaches involving third-party systems, with Allianz confirming it was a third-party customer relationship management platform. "On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life Insurance Company of North America (Allianz Life)," an Allianz Life spokesperson told BleepingComputer. While BleepingComputer has learned that the Qantas data breach also involved a third-party customer relationship management platform, the company will not confirm it is Salesforce. However, previous reporting from local media claims the data was stolen from Qantas' Salesforce instance. Furthermore, court documents state that the threat actors targeted "Accounts" and "Contacts" database tables, both of which are Salesforce objects. While none of these companies have publicly named Salesforce, BleepingComputer has since confirmed that all were targeted in the same campaign detailed by Google. The attacks have not led to public extortion or data leaks yet, with BleepingComputer learning that the threat actors are attempting to privately extort companies over email, where they name themselves as ShinyHunters. It is believed that when these extortion attempts fail, the threat actors will release stolen information in a long wave of leaks, similar to ShinyHunter's previous Snowflake attacks. "We have not identified any data leak sites associated with this activity," Genevieve Stark, Head of Cybercrime, and Information Operations Intelligence Analysis at GTIG, told BleepingComputer. "It is plausible that the threat actor intends to sell the data instead of sharing it publicly. This approach would align with prior ShinyHunters Group activity." Google say they are now tracking Salesforce data-theft attacks under multiple threat group designations. "GTIG attributes multiple incidents impacting Salesforce instances to UNC6040. In at least some cases, the follow-on extortion activity, which we attribute to the distinct threat cluster UNC6240, has used the ShinyHunters brand," Stark told BleepingComputer. "The extortion activity is attributed to UNC6240 instead of UNC6040 due to a significant time gap between the initial data theft activity and the subsequent extortion activity. We have not confirmed the nature of the relationship between these intrusions and the prior use of this handle on underground forums." Who is ShinyHunters The breaches have caused confusion among the cybersecurity community and the media, including BleepingComputer, with the attacks attributed to Scattered Spider (tracked by Mandiant as UNC3944), as those threat actors were also targeting the aviation, retail, and insurance sectors around the same time and demonstrated similar tactics. However, threat actors associated with Scattered Spider tend to perform full-blown network breaches, culminating with data theft and, sometimes, ransomware. ShinyHunters, tracked as UNC6040, on the other hand, tends to focus more on data-theft extortion attacks targeting a particular cloud platform or web application. It is BleepingComputer's and some security researchers' belief that both UNC6040/UNC6240 and UNC3944 consist of overlapping members that communicate within the same online communities. The threat group is also believed to overlap with "The Com," a network of experienced English-speaking cybercriminals. "According to Recorded Future intelligence, the overlapping TTPs between known Scattered Spider and ShinyHunters attacks indicate likely some crossover between the two groups," Allan Liska, an Intelligence Analyst for Recorded Future, told BleepingComputer. Other researchers have told BleepingComputer that ShinyHunters and Scattered Spider appear to be operating in lockstep, targeting the same industries at the same time, making it harder to attribute attacks. Some also believe that both groups have ties to threat actors from the now-defunct Lapsus$ hacking group, with reports indicating that one of the recently arrested Scattered Spider hackers was also in Lapsus$. Another theory is that ShinyHunters is acting as an extortion-as-a-service, where they extort companies on behalf of other threat actors in exchange for a revenue share, similar to how ransomware-as-a-service gangs operate. This theory is supported by previous conversations BleepingComputer has had with ShinyHunters, where they claimed not to be behind a breach, but just acting as the seller of the stolen data. These breaches include PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more. To muddy the waters further, there have been numerous arrests of people linked to the name "ShinyHunters," including those who have been arrested for the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum. Yet even after these arrests, new attacks occur with companies receiving extortion emails stating, "We are ShinyHunters," referring to themselves as a "collective." Protecting Salesforce instances from attacks In a statement to BleepingComputer, Salesforce emphasized that the platform itself was not compromised, but rather, customers' accounts are being breached via social engineering. "Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks," Salesforce told BleepingComputer. "We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/." Salesforce is urging customers to strengthen their security posture by: Enforcing trusted IP ranges for logins Following the principle of least privilege for app permissions Enabling multi-factor authentication (MFA) Restricting use of connected apps and managing access policies Using Salesforce Shield for advanced threat detection, event monitoring, and transaction policies Adding a designated Security Contact for incident communication Further details on these mitigations can be found in Salesforce's guidance linked above. Update 8/1/25: Added information from GTIG. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
11 shared
Jul 31, 2025
TeamPCP Moves From OSS to AWS Environments
This is the fourth update to the TeamPCP supply chain campaign threat intelligence report, "When the Security Scanner Became the Weapon" (v3.0, March 25, 2026). Update 003 covered developments through March 28, including the first 48-hour pause in new compromises and the campaign's shift to monetization. This update consolidates intelligence from March 28-30, 2026 -- two days since our last update. HIGH: Databricks Investigating Alleged Compromise Linked to TeamPCP Credential Harvest CybersecurityNews reports that Databricks, the cloud data analytics platform, is investigating an alleged security compromise linked to the TeamPCP credential harvest. International Cyber Digest stated on X that they "notified them last week" and Databricks "scaled up to investigate." A separate analyst corroborated that screenshots showing AWS artifacts, CloudFormation dumps, and STS tokens "match TeamPCP's exact playbook." Databricks has not issued an official statement. If confirmed, this would be the first major cloud platform identified as a downstream victim of TeamPCP's credential trove -- distinct from the security tool vendors (Aqua, Checkmarx, BerriAI, Telnyx) directly compromised in the supply chain phase. The distinction matters: tool vendor compromises expanded TeamPCP's credential pool, while a Databricks compromise would represent the monetization of that pool against an enterprise target processing sensitive data across AWS, GCP, and Azure. Update (2026-03-30): Databricks' Head of Global Communications and their external PR agency FGS Global have confirmed the authenticity of the new @DatabricksSec X account. In their https://x.com/DatabricksSec/status/2038649955401794042, Databricks says they "thoroughly investigated this information in our internal systems and found nothing" and have "asked for more information beyond this screenshot." They state they will "transparently continue to share any new updates on all security matters." Recommended action: Organizations using Databricks should monitor for an official statement. If your CI/CD pipelines were exposed to any TeamPCP-compromised component AND those pipelines had access to Databricks credentials, treat those credentials as potentially compromised regardless of whether Databricks confirms the breach. HIGH: TeamPCP Operates Dual Ransomware Tracks - CipherForce Is Their Own Operation Update 002 documented TeamPCP's partnership with the Vect ransomware-as-a-service operation and BreachForums mass affiliate key distribution. New intelligence reveals that Vect is not TeamPCP's only ransomware channel. According to Flare and corroborated by Rami McCarthy's IOC tracker, TeamPCP operates under five confirmed aliases: PCPcat, ShellForce, DeadCatx3, CipherForce, and Persy_PCP. TeamPCP's own Telegram channel states: "you may already know us as TeamPCP or Shellforce... CipherForce is a newer project we are starting to find affiliates." CipherForce is TeamPCP's own ransomware operation, separate from the Vect partnership. This means TeamPCP is running two parallel ransomware tracks simultaneously: their proprietary CipherForce program for direct operations, and the mass Vect affiliate program via BreachForums for distributed operations. The SANS ISC Stormcast for March 30 also notes "more and more links between the TeamPCP crew and various ransomware actors" -- plural -- consistent with this dual-track model. Analysts assess this dual-track approach allows TeamPCP to maintain direct control over high-value targets (via CipherForce) while simultaneously flooding the ecosystem with mass affiliate operations (via Vect). The 300 GB stolen credential trove can feed both tracks simultaneously. Recommended action: Detection teams monitoring for Vect ransomware indicators should also add CipherForce to their watchlist. The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure. HIGH: LAPSUS$ Releases AstraZeneca Data Free After Failed Sale Attempt The LAPSUS$/AstraZeneca breach claim documented in Updates 002-003 has escalated. Cybernews and Cybersecurity Insiders report two developments: LAPSUS$ released the claimed 3 GB archive for free after failing to find buyers via Session encrypted messaging. This shifts the incident from an extortion attempt to a full data exposure event. Cybernews research team has partially verified the dump's contents -- GitHub user information for internal AstraZeneca software developers, employee data spanning clinical research subsidiaries, and internal source code tree structures were assessed as consistent with legitimate AstraZeneca infrastructure. AstraZeneca has still not issued any public statement confirming or denying the breach at approximately 96 hours since the initial claim. Analysts assess that AstraZeneca's continued silence, combined with GDPR obligations if EU employee data is in the dump, creates increasing regulatory exposure with each passing day. Recommended action: Organizations should treat this as a probable confirmed breach for defensive planning purposes. If your organization shares integrations, data, or credentials with AstraZeneca, assess whether the exposed repository structures and configurations could affect your security posture. Given AstraZeneca's clinical research operations, the dump may contain protected health information (PHI) subject to HIPAA in the US and GDPR in the EU. Organizations with data-sharing agreements with AstraZeneca should evaluate whether their data may be in the exposed archive and prepare breach notification workflows accordingly. MEDIUM: ownCloud Discloses Build Infrastructure Impact From CVE-2026-33634 ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise). ownCloud confirms: no customer data compromised, no source code altered, impact limited to build systems only. This is one of the first named downstream organizations to publicly disclose that they were in the blast radius of the Trivy supply chain compromise. The disclosure is notable for its transparency -- most affected organizations have remained silent despite the CISA KEV entry and federal remediation deadline of April 8. Recommended action: Organizations using ownCloud should review the security notice and verify their deployments are using images produced after the remediation. More broadly, ownCloud's disclosure should prompt other organizations that used Trivy in their build pipelines between March 19-22 to conduct their own impact assessments and consider similar disclosure. MEDIUM: Supply Chain Pause Extends Past 96 Hours No new package compromises across any ecosystem have been publicly reported since the Telnyx PyPI disclosure on March 27, extending the supply chain pause documented in Update 003 past 96 hours. This is the longest quiet period since TeamPCP began active supply chain operations on March 19. Expanded ecosystem search results (March 30): An independent search of RubyGems, crates.io, and Maven Central -- the three ecosystems identified as plausible expansion targets in Update 003 -- found zero TeamPCP-related IOCs in any of them. The RubyGems, crates.io, and Maven Central watch items remain "Not observed." While the CanisterWorm's propagation technique is registry-agnostic (any stolen publish token would work), there is no evidence TeamPCP has moved beyond the five confirmed ecosystems (GitHub Actions, PyPI, npm, Docker Hub/GHCR, OpenVSX). Note on sourcing: CybersecurityNews listed "NPM and OpenVSX" alongside the other compromised ecosystems in their Databricks article. These are accurate in the sense that both ecosystems were hit, but they refer to the known CanisterWorm npm worm (March 20, 66+ packages) and the Checkmarx OpenVSX extensions (March 23, ast-results and cx-dev-assist) -- not new compromises. No new npm or OpenVSX activity has been documented since the original incidents. Recommended action: Use this supply chain pause as a remediation window. The CISA KEV deadline for CVE-2026-33634 is now 9 days away (April 8, 2026). Complete credential rotations and IOC sweeps before the deadline. HIGH: Campaign Transitions to Three Parallel Monetization Tracks While supply chain poisoning has paused, TeamPCP is not dormant. Analysts assess the group has completed its supply chain expansion phase and transitioned fully to credential exploitation and monetization. Three distinct operational tracks are now running simultaneously: Direct credential exploitation against high-value targets -- the Databricks investigation (see above) represents the first alleged downstream victim of the ~300 GB stolen credential trove, distinct from the tool vendors directly compromised in the supply chain phase. Proprietary ransomware via CipherForce -- TeamPCP's own ransomware operation, with recruitment via their Telegram channel. No confirmed deployments yet, but the infrastructure and affiliate recruitment are active. Mass affiliate ransomware via Vect/BreachForums -- Distributed operations leveraging the BreachForums mass affiliate key distribution documented in Update 002. The distribution window is now ~96 hours with no confirmed deployments. The distinction between these tracks matters for defenders: detection teams monitoring for Vect ransomware indicators should also add CipherForce to their watchlist. The shared RSA-4096 public key embedded in payloads is the strongest attribution link across all TeamPCP operations. INFO: Cloud Security Alliance Publishes Second Research Note on AI/ML Supply Chain Risk The Cloud Security Alliance AI Safety Initiative published a research note on March 29 framing the TeamPCP campaign as a structural shift in adversary methodology -- from opportunistic typosquatting to deliberate pipeline compromise of trusted AI/ML packages. The note assesses that "the economics of targeting high-value AI credential stores are accelerating adversary investment." This is the second CSA publication covering TeamPCP (the first was the Kubernetes wiper lab analysis documented in Update 003) and focuses specifically on the AI/ML ecosystem implications rather than technical TTPs. Watch Item Status The full campaign report is available at sans.org/white-papers/when-security-scanner-became-weapon. A SANS Emergency Webcast replay is available at sans.org/webcasts/when-security-scanner-became-weapon. Updates to the report will be in the form of these ISC diaries.
11 shared
Apr 4, 2026