How to Detect Klue Supply-Chain Attack Activity in Salesforce
Summary
Attackers used a dormant Klue credential to steal OAuth tokens and query connected Salesforce environments. Datadog shares log indicators, API activity patterns, and SIEM rules to help identify related data exfiltration.
Key points
- A dormant prototype-integration credential reportedly gave attackers access to Klue’s integration systems; they used stolen Salesforce and Gong OAuth tokens to reach customer environments.
- Klue identified anomalous activity on June 12, removed Salesforce access, and revoked customer OAuth credentials on June 13.
- Attackers used automated REST API queries, including QueryMore, to retrieve CRM data across objects such as Opportunity, Contact, Account, and Case.
- Huntress confirmed that CRM data at one victim included business contacts, price quotes, and sales communications.
- Salesforce logs can identify the Klue Battlecards app through fields such as application or connected_app_name; refresh-token activity may provide a supplementary signal.
- Look for unusual volumes of read-heavy API queries, failed requests, QueryMore operations, and the listed IP addresses and user agents.
- Datadog recommends investigating June 11–12 activity and provides Cloud SIEM rules for anomalous query results, queried tables, and OAuth-token logins from previously unseen networks.
Article Details
- Defense Focus
- Detect and investigate unauthorized Salesforce API access and CRM data exfiltration associated with the compromised Klue Battlecards integration.
- Detection Methods
- Search LoginEvent logs for application:"Klue Battlecards" and API or other event logs for connected_app_name:"Klue Battlecards".
- Treat OAuth refresh-token activity as a supplementary indicator: check login_sub_type values oauthrefreshtoken and "OAuth Refresh Token" in the relevant login logs.
- Identify REST API activity against the /services/data/v59.0/query endpoint, including QueryMore operations, and correlate client IPs, user agents, and connected application identifiers.
- Look for spikes in failed API requests alongside successful requests, anomalous query-result volumes, and read-heavy queries across multiple Salesforce objects.
- Scope API event volume by entity_name or queried_entities; the article identifies Opportunity, Case, Task, Lead, Contact, Account, User, Contract, Event, and Campaign as heavily targeted entities.
- Review ApiException messages in RestApi logs for unusual broad queries, including errors caused by oversized tables, required filters, or insufficient permissions.
- Correlate activity involving Klue Battlecards with the listed IP indicators and user-agent strings; the article characterizes the user agents as lower-confidence indicators.
- Data Sources
- Salesforce LoginEvent logs
- Salesforce Login object
- Salesforce Event Log File ApiTotalUsage and RestApi events
- Salesforce Real Time Monitoring ApiEvent events
- Salesforce audit log data
- Rule Types
- Cloud SIEM detection rules for anomalous Salesforce query-result volume
- Cloud SIEM detection rules for anomalous numbers of queried Salesforce tables
- Cloud SIEM detection rules for previously unseen networks used for application OAuth token logins
- Log search queries for Salesforce REST API query and QueryMore activity
- Defensive Actions
- Investigate Salesforce activity from June 11 to June 12 and cross-reference sessions associated with Klue Battlecards against the IP and user-agent indicators.
- Check Salesforce login and API event logs, as well as other services integrated with Klue, for the confirmed threat-actor infrastructure.
- Treat refresh-token detections as supplementary rather than primary signals, because the behavior appeared in only a subset of affected environments.
- Investigate anomalous read-heavy API activity across multiple objects, particularly when accompanied by the known indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 138[.]226[.]246[.]94 | IP address Klue confirmed as threat-actor infrastructure. |
| IPV4 | 212[.]86[.]125[.]24 | IP address Klue confirmed as threat-actor infrastructure. |
| IPV4 | 213[.]111[.]148[.]90 | IP address Klue confirmed as threat-actor infrastructure. |
| IPV4 | 94[.]154[.]32[.]160 | IP address Klue confirmed as threat-actor infrastructure. |
MITRE ATT&CK
T1119 · Automated CollectionScripts issued broad, automated API queries across Salesforce objects, including QueryMore requests to retrieve large amounts of data.T1528 · Steal Application Access TokenThe threat actor harvested OAuth tokens for Salesforce and Gong and used refresh tokens in some instances to maintain API access.T1530 · Data from Cloud StorageThe threat actor queried Salesforce objects through the API to obtain CRM data, including contacts, price quotes, and sales communications.
Threat Actors
Products
Datadog Cloud SIEMThis post summarizes what is known about the attack chain, then provides detection guidance for Salesforce environments monitored by Datadog Cloud SIEM.GongBy the time Klue alerted customers on June 13, the threat actor had already harvested OAuth tokens for Salesforce and Gong, and had begun querying those environments through automated API calls.Klue BattlecardsThe Klue Battlecards integration will appear in Salesforce logs under different field names depending on the event type.SalesforceBy the time Klue alerted customers on June 13, the threat actor had already harvested OAuth tokens for Salesforce and Gong, and had begun querying those environments through automated API calls.