Klue OAuth Breach Linked to Icarus Salesforce Data Theft
Summary
ReliaQuest and Huntress report attackers compromised Klue’s Battlecards integration, stole OAuth tokens and Salesforce data, and extorted customers. Huntress says it was affected. Klue disabled integrations, and customers were urged to revoke tokens and review logs.
Key points
- ReliaQuest and Huntress reported that attackers accessed Klue Battlecards integration service accounts and used customer OAuth tokens to query connected Salesforce environments.
- ReliaQuest observed reconnaissance through Salesforce’s REST API followed by data theft, including a burst of nearly 1,000 queries in 15 minutes in at least one environment.
- Huntress confirmed it was affected and said the stolen data included business contacts, sales communications, price quotes, competitive intelligence reports, and account data.
- The article attributes the extortion campaign to Icarus, citing extortion emails and a Session Messenger ID matching one on the group’s leak site.
- Huntress said there was no evidence that threat intelligence, customer telemetry, passwords, payment card information, or engineering systems were compromised.
- Salesforce disabled the Klue Battlecards connection; Klue also disabled integrations with other services while responding to the incident.
- Organizations using Klue integrations were advised to revoke and rotate OAuth tokens, terminate active sessions, and review SaaS and Salesforce logs for unusual activity.
Article Details
- Victim Organization
- Klue; multiple customer organizations using Klue Battlecards integrations were also affected
- Victim Domain
- Unknown
- Incident Type
- OAuth breach involving compromised backend systems, theft of customer OAuth tokens, unauthorized Salesforce API queries, data exfiltration, and extortion
- Data Types Exposed
- Business contacts
- Sales communications
- Price quotes
- Competitive intelligence reports
- Account data
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Salesforce disabled the Klue Battlecards integration during the investigation. Klue also disabled integrations with Salesforce and other third-party platforms while responding to the incident. Affected organizations were advised to revoke and rotate OAuth tokens, terminate sessions, and review logs.
- Ransom Or Extortion
- Affected customers reportedly received extortion emails attributed to Icarus. The ransom amount and any payment were not disclosed.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 138[.]226[.]246[.]94 | IP address reported by ReliaQuest and Huntress as linked to the attacks; organizations were advised to check for activity originating from it. |
| IPV4 | 212[.]86[.]125[.]24 | IP address reported by ReliaQuest and Huntress as linked to the attacks; organizations were advised to check for activity originating from it. |
| IPV4 | 213[.]111[.]148[.]90 | IP address reported by ReliaQuest and Huntress as linked to the attacks; organizations were advised to check for activity originating from it. |
| IPV4 | 94[.]154[.]32[.]160 | IP address reported by ReliaQuest and Huntress as linked to the attacks; organizations were advised to check for activity originating from it. |
MITRE ATT&CK
T1078.004 · Cloud AccountsAttackers reportedly used stolen OAuth tokens to access connected Salesforce environments.T1213 · Data from Information RepositoriesAttackers queried Salesforce CRM data, including business contacts, sales communications, and account data.T1567 · Exfiltration Over Web ServiceThe reported activity involved exfiltrating data through queries to Salesforce's REST API.
Threat Actors
Vendors
KlueKlue suffered an OAuth breach that allowed the Icarus threat actors to steal Salesforce CRM data from multiple organizations through compromised Battlecards integrations.SalesforceKlue suffered an OAuth breach that allowed the Icarus threat actors to steal Salesforce CRM data from multiple organizations through compromised Battlecards integrations.
Products
Klue BattlecardsThe incident triggered extortion emails, Salesforce disabled the Klue Battlecards integration, and affected customers were urged to revoke tokens and review logs.SalesforceKlue suffered an OAuth breach that allowed the Icarus threat actors to steal Salesforce CRM data from multiple organizations through compromised Battlecards integrations.