2025 Salesforce Breaches: ShinyHunters & Scattered Spider Unveiled

Executive Summary

In 2025, a potential alliance between ShinyHunters and Scattered Spider led to significant Salesforce breaches, impacting numerous victims. Obsidian Security's analysis uncovers tactics including social engineering and OAuth abuse that facilitated extensive CRM data theft. This detailed evaluation highlights the persistent threat of coordinated attacks in the cybersecurity landscape.

👉 Read the full article from Obsidian Security here for comprehensive insights.

Key Insights

1. The Merger of Threat Actors

• Obsidian Security reveals a potential collaboration between ShinyHunters and Scattered Spider, indicating an escalation in their attack strategies.
• This coalition suggests a more sophisticated approach to targeting organizations, particularly using Salesforce as a platform.

2. Overlapping Tactics and Techniques

• Researchers identified shared techniques, predominantly revolving around social engineering and OAuth abuse, allowing for unauthorized access to sensitive data.
• This overlap indicates a shift in tactics that may influence future attack patterns across the cybersecurity landscape.

3. Victim Profile and Impact

• The breaches have affected numerous Salesforce customers, highlighting the widespread nature of CRM data theft.
• Understanding the profiles of these victims can help businesses fortify their defenses against similar attacks.

4. Chaotic Telegram Activity

• Analysis of Telegram channels showcases the chaotic nature of communications among these threat actors, revealing their methodology and operational dynamics.
• This analysis contributes valuable insights into the evolving nature of cybercriminal networks and their coordination efforts.

👉 Access the full expert analysis and actionable security insights from Obsidian Security here.