Image: Adobe Stock
Google Threat Intelligence Group shared its findings about a threat actor responsible for stealing Salesforce customer data via Salesloft Drift.
A previously unidentified threat actor, UNC6395, has been linked to a recent breach campaign that exposed Salesforce customer data. The activity, which occurred between early and mid-August, involved the misuse of OAuth tokens issued through Salesloft Drift integration.
Google Threat Intelligence Group (GTIG) identified the threat actor in an Aug. 26 post and noted the “widespread data theft” started as early as Aug. 8, 2025 and ran through at least Aug. 18, 2025.
UNC6395 used targeted database queries to extract records containing personal user data, account profiles, case logs, and similar sensitive information. After pulling the data, the group exported the results in an apparent effort to collect login credentials and cloud access keys.
According to Salesloft, users that haven’t yet integrated with Salesforce were not affected by the attack. In a joint effort, Salesloft and Salesforce revoked active access and refresh tokens associated with Drift. The app was also pulled from the Salesforce AppExchange while the investigation remains ongoing.
GTIG has published a list of known indicators of compromise (IOCs) involving the recent attacks. These include:
Any match with these IOCs in your logs may point to a compromise and should prompt immediate investigation.
If you believe your system has been compromised, or if you want to proactively protect your system from UNC6395, consider the following recommendations from GTIG:
These recommendations can all go a long way in safeguarding your system from UNC6395 and other, similar threats whether you’ve been compromised or not.
UNC6395’s exploitation of OAuth tokens shows how easily attackers can leverage trusted authentication mechanisms to bypass modern cyberdefenses. The sooner organizations treat OAuth token security as a top priority, the sooner they can close a door that attackers like UNC6395 are all too eager to exploit.
What is keeping cybersecurity experts up at night? TechnologyAdvice’s Matt Gonzales reported from Black Hat 2025 the answers to that question.
J.R. Johnivan is a technology writer and computer repair professional with 20 years of experience. His work explores emerging technologies, including next-generation LLMs, their societal impact, and how they can improve professional workflows. He began writing while studying computer networking, eventually combining his passion for technology with a career in content. He also brings expertise in project management, HR, and CRM software, giving him a practical, business-focused perspective on today’s tech landscape.
