Oktacron - Cyber Security RSS Feeds History

Google Confirms Salesforce Database Breach by ShinyHunters Group

cyberexpress Aug 07, 2025 Firewall Daily

Google has confirmed that a corporate Salesforce database it used to manage small and medium business (SMB) contacts was compromised by a known cybercriminal group. The attackers, identified as ShinyHunters, tracked internally by Google as UNC6040, gained unauthorized access to the database in June 2025. In a blog show more ...

post released Tuesday by Google’s Threat Intelligence Group (GTIG), the company stated that attackers were able to retrieve “basic and largely publicly available business information, such as business names and contact details,” before the breach was contained. The data was stored within one of Google’s internal Salesforce instances used for managing SMB engagement. Attack Method: Voice Phishing and Data Loader Abuse The breach did not stem from a technical vulnerability in the Salesforce platform but was enabled by voice phishing (vishing) tactics. The attackers impersonated IT personnel and called employees, persuading them to authorize a malicious connected application in their organization’s Salesforce environment. The malicious app, often a modified version of Salesforce’s official Data Loader tool, allowed the attackers to exfiltrate data. In several cases, the attackers disguised the application under misleading names like “My Ticket Portal” to align with the vishing pretext. Once access was granted, the attackers used custom Python scripts, replacing earlier reliance on the official Data Loader, to automate the data collection process. These scripts mimicked legitimate Salesforce data tools and operated through TOR or VPN services such as Mullvad, making attribution more difficult. UNC6040 and the Emergence of UNC6240 GTIG identified the actors behind this campaign as UNC6040, a financially motivated group focused on compromising Salesforce environments through social engineering. After the initial data theft, another threat cluster, UNC6240, has been observed initiating extortion attempts targeting affected organizations. These extortion efforts typically begin weeks or months after the original breach. Emails and calls from UNC6240 demand Bitcoin payments within 72 hours and threaten public disclosure of stolen data. These messages often claim affiliation with ShinyHunters, a name already linked to multiple high-profile data breaches over the past few years. GTIG listed known extortion email addresses used by the group: shinycorp@tuta[.]com shinygroup@tuta[.]com Additionally, evidence suggests the attackers are preparing a data leak site (DLS) to publish stolen information, a tactic commonly used by ransomware groups to pressure victims into paying. Infrastructure and Tactics The attackers used infrastructure that included phishing panels designed to mimic Okta login pages, which were used during the vishing calls. These panels targeted users' credentials and multi-factor authentication (MFA) codes in real time. There was also evidence of the attackers using compromised third-party accounts, not trial Salesforce accounts, to register their malicious applications, indicating an evolution in tactics and a higher level of operational security. GTIG noted that the group appears to prioritize English-speaking employees at multinational companies and often targets IT staff, leveraging their elevated access levels. In some cases, only partial data was extracted before detection. One actor retrieved only about 10% of the targeted records using small data chunks, while in other incidents, the attackers increased extraction volumes after conducting test queries. Conclusion This breach highlights a growing trend of attacks on cloud-based Salesforce systems, with threat groups such as ShinyHunters employing voice-based social engineering and delayed extortion tactics. GTIG has observed links between these actors and broader collectives like The Com, known for phishing and hacking. The abuse of Salesforce integrations, particularly connected apps and OAuth tokens, demonstrates that technical defenses are insufficient without user vigilance. Organizations should tighten access controls, enhance MFA, and train staff to resist social engineering, while preparing for long-term risks even after initial breaches appear limited.

Microsoft to Pull Plug on Shared EWS Access in Hybrid Exchange by October

cyberexpress Aug 07, 2025 Firewall Daily

Organizations using Exchange hybrid deployments should prepare for new changes taking effect over the next few months. Microsoft has announced that beginning in August 2025, it will temporarily block Exchange Web Services (EWS) traffic that uses the Exchange Online shared service principal in certain hybrid show more ...

environments. The change primarily impacts organizations using "rich coexistence" features such as free/busy calendar lookups, MailTips, and profile picture sharing between on-premises Exchange Server and Exchange Online mailboxes. These features rely on EWS and have traditionally functioned through the shared service principal in Exchange Online. However, Microsoft will permanently disable this method starting October 31, 2025. In preparation, temporary disruptions will occur throughout August, September, and October 2025 to prompt customers to make the necessary updates. These blocks are designed to ensure that affected organizations don’t overlook the October deadline. The company stresses the security benefits of this shift. Moving away from the shared service principal reduces exposure to known risks, including CVE-2025-53786, a post-exploitation vulnerability that highlights the need for stronger authentication controls. Who Will Be Affected by Exchange Web Services (EWS) Discontinuation? Not all hybrid Exchange environments will be impacted by these disruptions. Only organizations meeting the following criteria will experience feature breaks during the temporary blocks: Mailboxes are hosted both in Exchange on-premises and Exchange Online. Rich coexistence features (free/busy, MailTips, profile pictures) are in use between on-prem and cloud users. On-premises Exchange servers are not updated to a version that supports the dedicated hybrid app. The dedicated Exchange hybrid app has not been created or properly enabled. Organizations meeting these conditions should act immediately to avoid functionality loss. Microsoft has also issued Message Center notification MC1085578 to affected tenants. What Will Break and When? The impact is limited but specific. During blocked periods, on-premises mailboxes will be unable to access rich coexistence features for Exchange Online mailboxes. These include: Free/busy calendar lookups MailTips Profile picture sharing It’s important to note that these disruptions are one-way only, they affect on-premises users accessing cloud data, not vice versa. All other hybrid features will continue to work. Support teams will not grant exceptions for these blocks. Organizations needing assistance should consult the documentation or reach out to Microsoft support. What Organizations Need to Do For organizations using rich coexistence features, Microsoft recommends two primary actions: Update Exchange Server to a version that supports the dedicated hybrid app. Create and enable the dedicated Exchange hybrid application using the new Hybrid Configuration Wizard (HCW) or a provided configuration script. Supported minimum Exchange versions include: Exchange Server 2016 CU23 – Version 15.1.2507.55 or newer (April 2025 HU) Exchange Server 2019 CU14 – Version 15.2.1544.25 or newer (April 2025 HU) Exchange Server 2019 CU15 – Version 15.2.1748.24 or newer Exchange Subscription Edition (SE) – Version 15.2.2562.17 or newer The updated Hybrid Configuration Wizard simplifies the setup of the dedicated app. When selected during the HCW process (Classic Full, Modern Full, or Choose Exchange Hybrid Configuration), the wizard: Registers a new application in Entra ID with a unique identifier. Adds EWS permissions (to be replaced with Microsoft Graph permissions in the future). Uploads current and future authentication certificates. Removes expired certificates. Requests tenant-wide admin consent. However, HCW does not automatically enable the dedicated app within the on-premises Exchange environment. A separate Setting Override must be created to fully activate the feature. Instructions are available in the Deploy dedicated Exchange hybrid app documentation. Conclusion Even for organizations not using rich coexistence features, it's important to perform a security cleanup. Running the Exchange Hybrid Configuration Wizard or configuring OAuth may have left custom certificates on the shared service principal, which should be removed using the provided script in Service Principal Clean-Up Mode. This process can be carried out from any Windows machine and does not require a specific Exchange version or server. As Microsoft moves toward permanently blocking Exchange Web Services (EWS) traffic via the shared service principal after October 31, 2025, transitioning to the dedicated Exchange hybrid app is a critical step in securing hybrid Exchange deployments. Administrators should act now to ensure their environments are fully updated and aligned with the latest guidance, using the updated Hybrid Configuration Wizard and official documentation to avoid any disruption.

UEBA rules in Kaspersky SIEM | Kaspersky official blog

kaspersky Aug 07, 2025 Business

Todays cyberattackers are masters of disguise — working hard to make their malicious activities look like normal processes. They use legitimate tools, communicate with command-and-control servers through public services, and mask the launch of malicious code as regular user actions. This kind of activity is almost show more ...

invisible to traditional security solutions; however, certain anomalies can be uncovered by analyzing the behavior of specific users, service accounts, or other entities. This is the core concept behind a threat detection method called UEBA, short for user and entity behavior analytics. And this is exactly what weve implemented in the latest version of our SIEM system — Kaspersky Unified Monitoring and Analysis Platform. How UEBA works within an SIEM system By definition, UEBA is a cybersecurity technology that identifies threats by analyzing the behavior of users, devices, applications, and other objects in an information system. While in principle this technology can be used with any security solution, we believe its most effective when integrated in an SIEM platform. By using machine learning to establish a normal baseline for a user or objects behavior (whether its a computer, service, or another entity), an SIEM system equipped with UEBA detection rules can analyze deviations from typical behavior. This allows for the timely detection of APTs, targeted attacks, and insider threats. This is why weve equipped our SIEM system with an UEBA rule package — designed specifically to detect anomalies in authentication processes, network activity, and the execution of processes on Windows-based workstations and servers. This makes our system smarter at finding novel attacks that are difficult to spot with regular correlation rules, signatures, or indicators of compromise. Every rule in the UEBA package is based on profiling the behavior of users and objects. The rules fall into two main categories: Statistical rules, which use the interquartile range to identify anomalies based on current behavior data. Rules that detect deviations from normal behavior, which is determined by analyzing an account or objects past activity. When a deviation from a historical norm or statistical expectation is found, the system generates an alert and increases the risk score of the relevant object (user or host). (Read this article to learn more about how our SIEM solution uses AI for risk scoring.) Structure of the UEBA rule package For this rule package, we focused on the areas where UEBA technology works best — such as account protection, network activity monitoring, and secure authentication. Our UEBA rule package currently features the following sections: Authentication and permission control These rules detect unusual login methods, sudden spikes in authentication errors, accounts being added to local groups on different computers, and authentication attempts outside normal business hours. Each of these deviations is flagged, and increases the users risk score. DNS profiling Dedicated to analysis of DNS queries made by computers on the corporate network. The rules in this section collect historical data to identify anomalies like queries for unknown record types, excessively long domain names, unusual zones, or atypical query frequencies. It also monitors the volume of data returned via DNS. Any such deviations are considered potential threats, and thus increase the hosts risk score. Network activity profiling Tracking connections between computers both within the network and to external resources. These rules flag first-time connections to new ports, contacts with previously unknown hosts, unusual volumes of outgoing traffic, and access to management services. All actions that deviate from normal behavior generate alerts and raise the risk score. Process profiling This section monitors programs launched from Windows system folders. If a new executable runs for the first time from the System32 or SysWOW64 directories on a specific computer, its flagged as an anomaly. This raises the risk score for the user who initiated the process. PowerShell profiling This section tracks the source of PowerShell script executions. If a script runs for the first time from a non-standard directory — one that isnt Program Files, Windows, or another common location — the action is marked as suspicious and increases the users risk score. VPN monitoring This flags a variety of events as risky — including logins from countries not previously associated with the users profile, geographically impossible travel, unusual traffic volumes over a VPN, VPN client changes, and multiple failed login attempts. Each of these events results in a higher risk score for the users account. Using these UEBA rules helps us detect sophisticated attacks and reduce false positives by analyzing behavioral context. This significantly improves the accuracy of our analysis and lowers the workload of security analysts. Using UEBA and AI to assign a risk score to an object speeds up and improves each analysts response time by allowing them to prioritize incidents more accurately. Combined with the automatic creation of typical behavioral baselines, this significantly boosts the overall efficiency of security teams. It frees them from routine tasks, and provides richer, more accurate behavioral context for threat detection and response. Were constantly improving the usability of our SIEM system. Stay tuned for updates to the Kaspersky Unified Monitoring and Analysis Platform on its official product page.

Researcher Deploys Fuzzer to Test Autonomous Vehicle Safety

darkreading Aug 07, 2025 Feed

As autonomous vehicles continue to evolve, this research highlights the importance of rigorous security testing to protect against both intentional attacks and unintentional unsafe commands in teleoperation systems.

Prime Security Wins Black Hat's Startup Spotlight Competition

darkreading Aug 07, 2025 Feed

Security startups of all stripes submitted applications for Black Hat USA's Startup Spotlight. Prime Security won with its AI security architect platform.

Payback: 'ShinyHunters' Clocks Google via Salesforce

darkreading Aug 07, 2025 Feed

In 2024, it was Snowflake. In 2025, it's Salesforce. ShinyHunters is back, with low-tech hacks that nonetheless manage to bring down international megaliths like Google, Cisco, and Adidas.

Air France, KLM Alert Authorities of Data Breach

darkreading Aug 07, 2025 Feed

While no sensitive financial data like credit card information was compromised, the threat actors were able to get away with names, email addresses, phone numbers, and more.

Critical Zero-Day Bugs Crack Open CyberArk, HashiCorp Password Vaults

darkreading Aug 07, 2025 Feed

Secrets managers hold all the keys to an enterprise's kingdom. Two popular ones had longstanding, critical, unauthenticated RCE vulnerabilities.

Citizen Lab Founder Flags Rise of US Authoritarianism

darkreading Aug 07, 2025 Feed

Citizen Lab director and founder Ron Deibert explained how civil society is locked in "vicious cycle," and human rights are being abused as a result, covering Israeli spyware, the Khashoggi killing, and an erosion of democratic norms in the US.

Chanel Alerts Clients of Third-Party Breach

darkreading Aug 07, 2025 Feed

The fashion house is added to a list of other companies that have been impacted by similar breaches, including Tiffany & Co. and Louis Vuitton.

The Critical Flaw in CVE Scoring

darkreading Aug 07, 2025 Feed

With informed decision-making, organizations can strengthen their overall resilience and maintain the agility needed to adapt to emerging threats, without sacrificing innovation or productivity.

'Samourai' Cryptomixer Founders Plead Guilty to Money Laundering

darkreading Aug 07, 2025 Feed

As part of their plea deal, the cybercriminal founders will also have to forfeit more than $200 million.

Privilege Escalation Issue in Amazon ECS Leads to IAM Hijacking

darkreading Aug 07, 2025 Feed

A software developer discovered a way to abuse an undocumented protocol in Amazon's Elastic Container Service to escalate privileges, cross boundaries and gain access to other cloud resources.

Cyberattack hits France’s third-largest mobile operator, millions of customers affected

cyware Aug 07, 2025 Industry

Bouygues Telecom, a large French mobile carrier, disclosed a cyberattack and data breach affecting more than 6 million customer accounts.

CISA, Microsoft issue alerts on ‘high-severity’ Exchange vulnerability

cyware Aug 07, 2025 Technology

Organizations with on-premises Microsoft Exchange servers are being urged to take steps to reduce exposure to a vulnerability recently reported by a researcher.

Germany’s top court holds that police can only use spyware to investigate serious crimes

cyware Aug 07, 2025 Government

The plaintiffs argued that a 2017 rules change enabling law enforcement to use spyware to eavesdrop on encrypted chats and messaging platforms could unfairly expose communications belonging to people who are not criminal suspects.