Microsoft Details Three Scenarios for ShinyHunters' Attacks on Salesforce

Microsoft has published an analysis of attacks whose techniques match the signature of the data-extortion group ShinyHunters. According to the company, over the past year the attackers gained access to corporate Salesforce environments without exploiting a single vulnerability in the platform itself.

Instead, the attackers leveraged the trust that organizations had already extended to third-party services. The main vector of intrusion was OAuth connections linking Salesforce to applications and external providers.

Three Paths of Attack

Microsoft identified three distinct scenarios through which ShinyHunters gained access to Salesforce customers' data. The common thread across all of them is the abuse of already-existing trusted integrations, rather than the search for and exploitation of technical flaws in the platform itself.

What This Means for Companies

The campaign described underscores that the security perimeter of modern SaaS platforms extends far beyond the service itself. Even in the absence of vulnerabilities in Salesforce, the risk persists because of the many third-party applications and API connections to which organizations grant access to their data.

Analysts recommend that companies regularly review the list of applications connected via OAuth, revoke unused integrations, and closely monitor the access rights granted to third-party services. It was precisely such connections, and not the platform itself, that became the entry point for the attackers over the year-long series of attacks.

Microsoft did not provide exact figures on the number of affected organizations, limiting itself to describing the methods used by the ShinyHunters group.

Source: The Hacker News