Hackers use Vishing to breach Salesforce customers and swipe data – Source: www.csoonline.com

In an active campaign, a financially motivated threat actor is voice phishing (Vishing) Salesforce customers to compromise their organizational data and carry out subsequent extortion.

Tracked as UNC6040 by Google Threat Intelligence Group (GTIG), the threat actor group targets employees within English-speaking branches of multinational corporations to trick them into granting sensitive access or sharing credentials.

“Over the past several months, UNC6040 has demonstrated repeated success in breaching networks by having its operators impersonate IT support personnel in convincing telephone-based social engineering engagements,” GITG researchers said in a report shared with CSO ahead of its official release on Wednesday.

Specifically, employees are being duped into approving malicious “connected app” – altered versions of Salesforce’s Data Loader, which, once authorized, give attackers direct access to exfiltrate large volumes of sensitive Salesforce data.

None of the observed cases in the campaign found threat actors exploiting any Salesforce vulnerability, researchers noted.

Abusing Salesforce’s App integration functionality

The campaign centers on Salesforce’s Data Loader, a bulk data management tool that lets users import, export, update, delete, or insert large volumes of records within the Salesforce platform. It comes with both a user-friendly interface and a command-line option for advanced customization and automation.

The tool supports OAuth and can be directly integrated as a “connected app” within Salesforce. According to GTIG, attackers are exploiting this by convincing victims, often during phone calls, to open the connected apps setup page and enter a connection code, effectively linking a rogue, attacker-controlled version of Data Loader to the victim’s Salesforce environment.

The capability of using the modified versions of Data Loader was found consistent with a recent guidance Salesforce had issued on such abuses. On this occasion, GTIG researchers found that the capability and technique differed from one intrusion to another.

“In one instance, a threat actor used small chunk sizes for data exfiltration from Salesforce but was only able to retrieve approximately 10% of the data before detection and access revocation,” researchers said. “In another case, numerous test queries were made with small chunk sizes initially. Once sufficient information was gathered, the actor rapidly increased the exfiltration volume to extract entire tables.”

Another trick involved naming the modified Data Loader “My Ticket Portal” to match the IT support pretext used during the Vishing calls.

Lateral movement for further extortion

After breaching Salesforce, the group moves laterally across cloud services, targeting tools like Okta, Microsoft 365, and Workplace to widen the scope of the breach.

Researchers point out that, in some cases, extortion attempts have surfaced months after the initial intrusion, with the threat actors even claiming ties to the infamous group ShinyHunters, likely as a pressure tactic.

The delay in extortion demands also hints that UNC6040 might be selling or handing off stolen data to other threat actors, who then use it for extortion, resale, or further attacks.

GTIG findings suggest that UNC6040 may be a part of a larger criminal network, where different groups handle different stages of an attack. This is based on observed similarities in tactics, techniques, and procedures (TTPs) between UNC6040 and other threat actors linked to a loosely connected collective known as “The Com”, which Scattered Spider is part of.

GTIG noted that while platforms like Salesforce offer strong built-in protections, it’s up to the customers to properly configure access, manage permissions, and ensure users are trained according to best practices.

A few cloud shared-responsibility best practices to consider include adhering to the principle of least privilege, monitoring access to connected applications, enforcing IP-based Access restrictions, and Multi-factor Authentication (MFA). UNC6040’s tactics aren’t isolated. Similar voice-driven social engineering campaigns have surfaced in recent months, including Scattered Spider’s hybrid Vishing attacks observed in May 2024, and the Letscall malware campaign in South Korea.