UNC6395 showed that one compromised SaaS integration can hand an attacker the OAuth tokens of hundreds of customers at once, with no phishing and no login prompt to defeat. Google Threat Intelligence Group (GTIG) named the cluster in August 2025 after it used OAuth tokens stolen from the Salesloft Drift chatbot platform to export data from customer Salesforce instances, then mined that data for AWS keys, passwords and Snowflake tokens. This profile covers who the actor is, the route from a vendor's GitHub account to customer CRMs, the ATT&CK techniques involved, the non-human identities it abused, and the detection, revocation and hardening steps that matter. It is for Salesforce and SaaS administrators, identity and NHI teams, and threat intelligence analysts.
Key takeaways
- The token store was the target. According to Salesloft's update on Mandiant's findings, the actor moved from Salesloft's GitHub account into Drift's AWS environment and took the OAuth tokens Drift held for its customers' integrations.
- Credential harvesting was the intent. GTIG assessed that the actor exported Cases, Accounts, Users and Opportunities mainly to search them for secrets such as AKIA access key IDs, passwords and Snowflake credentials.
- Integration traffic looks legitimate. The activity came through an approved connected app using valid tokens, so the useful signals are user agents, Tor source addresses, bulk queries and deleted jobs, not failed logins.
- Revocation has to cover everything connected. GTIG widened its advice on 28 August 2025: treat every authentication token stored in or connected to Drift as potentially compromised, not only the Salesforce one.
- Support cases are a secret store. Customers paste keys and logs into tickets; Cloudflare rotated 104 of its own API tokens after finding the actor had read its Case objects.
Who they are (names and aliases)
UNC6395 is GTIG's designation for the actor behind the Salesloft Drift campaign. "UNC" marks an uncategorised cluster. GTIG's advisory makes no attribution to a country or a named criminal group, and limits its assessment to the actor's intent, tooling and infrastructure. Cloudflare's threat intelligence team, Cloudforce One, tracks the activity it observed as GRUB1 and says GTIG's disclosures aligned with what it saw.
UNC6395 is not the same as UNC6040, the cluster behind the separate 2025 voice phishing campaign against Salesforce customers that MITRE ATT&CK records as campaign C0059 (Salesforce Data Exfiltration). GTIG's advisory does not link UNC6395 to ShinyHunters, and neither does this profile; see the ShinyHunters Threat Actor Profile for that separate campaign. As of ATT&CK v20 there is no group entry for UNC6395.
Targeting and motivation
The victims were Salesloft Drift customers that had connected Drift to Salesforce, and in a smaller number of cases to Google Workspace through the Drift Email integration. Selection was a consequence of the vendor compromise rather than sector choice, although disclosed victims included many security and technology companies, among them Cloudflare, Zscaler and Palo Alto Networks.
The objective, in GTIG's assessment, was further access: the actor searched exported records for credentials that would let it break into other platforms. That makes UNC6395 a second-stage risk for every organisation that kept secrets in CRM records.
| Date (2025) | Event | Source |
|---|---|---|
| 22 March | Start of the intrusion timeline, including API calls from Tor and anonymising proxies | Salesloft (Mandiant summary) |
| March to June | Access to Salesloft's GitHub account: repositories downloaded, a guest user added, workflows set up; then access to Drift's AWS environment and customer OAuth tokens | Salesloft (Mandiant findings) |
| 8 to 18 August | Data theft from customer Salesforce instances | GTIG |
| 9 August | Drift Email tokens used to read mail in a very small number of Google Workspace accounts | GTIG |
| 12 to 17 August | Access to Cloudflare's tenant, reconnaissance, then a Bulk API 2.0 export on 17 August | Cloudflare |
| 20 August | Salesloft and Salesforce revoke all active Drift access and refresh tokens | GTIG |
| 26 and 28 August | GTIG advisory and update widening scope to all Drift-connected tokens | GTIG |
| 5 to 16 September | Drift taken offline, then restored | Salesloft |
Tactics and techniques (MITRE ATT&CK)
Neither GTIG nor Cloudflare published ATT&CK IDs. The mapping below is ours, from their documented behaviour, checked against ATT&CK v20.
| Tactic | Technique (ATT&CK v20) | Documented behaviour |
|---|---|---|
| Collection (vendor) | T1213.003 Data from Information Repositories: Code Repositories | Content downloaded from multiple Salesloft GitHub repositories |
| Credential access (vendor) | T1552 Unsecured Credentials | Environment variable secrets exfiltrated; customer OAuth tokens taken from Drift's AWS environment |
| Initial access (customers) | T1199 Trusted Relationship | Entry through an approved third-party integration |
| Lateral movement | T1550.001 Use Alternate Authentication Material: Application Access Token | Stolen Drift OAuth tokens used against Salesforce and Workspace APIs |
| Discovery | T1526 Cloud Service Discovery | Object listing, Case schema retrieval, COUNT() queries and API limit checks |
| Collection | T1213.004 Data from Information Repositories: Customer Relationship Management Software | SOQL exports of Cases, Accounts, Users and Opportunities |
| Exfiltration | T1567 Exfiltration Over Web Service | Bulk API 2.0 jobs pulled over HTTPS |
| Stealth | T1070 Indicator Removal | Query jobs deleted after export; GTIG notes logs were not affected |
| Command and control | T1090.003 Proxy: Multi-hop Proxy | Tor exit nodes, plus DigitalOcean and AWS hosts |
| Credential access | T1552 Unsecured Credentials | Exported records searched for AKIA keys, passwords and Snowflake tokens; Cloudflare saw TruffleHog used to test a token |
How they abuse identities and credentials
UNC6395 is a case study in non-human identity compromise from start to finish.
- Developer platform credentials: Salesloft's summary of Mandiant's findings cites use of Salesloft GitHub personal access tokens for reconnaissance and secret enumeration. A guest user added to the GitHub organisation gave persistence that a password reset would not remove. See How to audit GitHub Apps and OAuth apps in an organisation.
- A central token store: Drift held refresh and access tokens for every customer that connected Salesforce or Workspace. Whoever reads that store inherits every customer's delegated access. This is why integration vendors' token vaults deserve the controls of a privileged credential store.
- The integration user: in Salesforce, the connected app ran as a Drift connection user, often with API Enabled and broad read access. Its activity is legitimate by design, so it is rarely alerted on. See How to review Salesforce connected apps and integration users.
- Secrets in business records: the export was a means to an end. AWS keys, Snowflake credentials and VPN or SSO login URLs found in case text become the next intrusion.
- Token lifetime: refresh tokens without strict expiry or IP binding stay useful until someone revokes them. See the OAuth Refresh Token Rotation and Expiry Guide.
Notable incidents
- Salesloft Drift campaign, August 2025: our full analysis is the Salesloft Drift Breach 2025 page.
- Cloudflare: exposure limited to text fields of support Case objects and customer contact details; 104 Cloudflare API tokens rotated with no misuse found.
- Palo Alto Networks: business contact and basic support case data in its CRM; see the victim's view in Palo Alto Networks Salesforce Data Theft 2025.
- Google Workspace: Drift Email tokens used on 9 August 2025 against a very small number of accounts configured for the integration; Google revoked the tokens and disabled the integration.
Detection and defence
Hunt for the activity
| Signal | Where to look | Notes |
|---|---|---|
| User agents Salesforce-Multi-Org-Fetcher/1.0 and Salesforce-CLI/1.0 | Salesforce Event Monitoring (API and login events) | Flagged as malicious by GTIG |
| python-requests/2.32.4 or Python/3.11 aiohttp/3.12.15 from the integration user | Event Monitoring | Generic; suspicious when the integration normally uses another client |
| API calls from Tor exit nodes, or from cloud hosting ranges not used by the vendor | Connected app authentication and API events | GTIG advises hunting all Tor activity, not only listed IPs |
| COUNT() queries on Account, User, Case and Opportunity, then large SELECTs | UniqueQuery events (executed SOQL) | Reconnaissance followed by export |
| Bulk API 2.0 job created and deleted within minutes | Bulk API events and setup audit trail | Matches the deletion pattern Cloudflare recorded |
| Calls to token verification endpoints from unknown hosts | Logs of the platforms whose keys sat in CRM records | Cloudflare saw TruffleHog testing a token |
Event Monitoring retention and event types depend on licence, so confirm what you hold before an incident. See the Salesforce Event Monitoring Detection Guide.
Respond
- Revoke the integration's tokens in Salesforce and every other platform connected to the same vendor, and disconnect the app until the vendor confirms containment.
- Ask the platform's support for the exact queries run by the integration user, as GTIG recommended for Salesforce.
- Search Cases, notes and custom objects for AKIA, snowflakecomputing.com, password, secret, key and internal login URLs; scan with a secrets detection tool.
- Rotate every secret found, and every key or token you ever shared with the vendor through tickets, then check those platforms' logs for use since March 2025.
- Reset passwords for associated user accounts and shorten session timeouts.
The OAuth Token Theft Incident Playbook covers the full sequence.
Harden
- Minimum scopes: avoid the full scope for connected apps; grant only the objects the integration needs.
- Bind the token to the network: set the connected app's IP Relaxation to "Enforce IP restrictions" and define Login IP Ranges on the integration user's profile.
- API Enabled by permission set: remove it from profiles and assign it only to named integration and admin users.
- Keep secrets out of tickets: give customers and staff a secure upload route and redact keys automatically in support tooling.
- Vendor due diligence: ask integration vendors how they store customer tokens, who can read them and how fast they can revoke them. See the SaaS and OAuth App Governance Guide.
Metrics
- Number of connected apps with the full scope or with no IP restriction (target zero).
- Percentage of integration users with API access granted through a permission set rather than a profile.
- Time to revoke all tokens for a named vendor across every connected platform.
- Number of live secrets detected in CRM and support records per quarter, trending to zero.
- Percentage of integration users with behavioural alerting on user agent, source and volume.
Framework mapping
| Defensive need | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Third-party integration risk | SA-9 External System Services | GV.SC-07 |
| Token and secret management | IA-5 Authenticator Management; IA-9 Service Identification and Authentication | PR.AA-01 |
| Least privilege scopes | AC-6 Least Privilege | PR.AA-05 |
| Monitor provider activity | SI-4 System Monitoring; AU-6 | DE.CM-06 |
| Incident handling | IR-4 Incident Handling | DE.AE-02 |
Practitioner checklist
- List every connected app and third-party integration in Salesforce and Workspace, with owner, scopes and token age.
- Hunt Event Monitoring for the GTIG user agents, Tor sources and deleted Bulk API jobs from March 2025 onward.
- Search CRM and support records for secrets and rotate everything found.
- Enforce IP restrictions and minimum scopes on every connected app that supports them.
- Move API Enabled from profiles to permission sets.
- Prepare a vendor-wide token revocation runbook that covers all platforms one vendor touches.
- Add integration vendors' token storage and revocation capability to third-party risk reviews.
Standards and references
- Google Cloud (GTIG): Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
- Salesloft: Drift/Salesforce Security Notification
- Cloudflare: The impact of the Salesloft Drift breach on Cloudflare and our customers
- MITRE ATT&CK: Use Alternate Authentication Material: Application Access Token
- MITRE ATT&CK: Trusted Relationship
- MITRE ATT&CK: Salesforce Data Exfiltration (C0059), a separate campaign
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Gong, Drift and Sales Engagement OAuth Integration Security Guide · Salesforce Security Guide · How to detect use of a stolen OAuth refresh token · UNC5537 (Snowflake customer data theft) threat actor profile · Threat Actor Groups Guide