Product
Box
- First Reported
- Jul 3, 2025
- Latest Reported
- Sep 7, 2026
Reported Context (2)
- The attackers focus on executives, then harvest data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands, with overlaps suggesting ties to UNC6671 and possibly Cinder/Pink. PREY-0058 Uses Help Desk Vishing and Token Theft to Steal SaaS Data and Extort Victims
- Following the mass adoption of remote and hybrid working patterns, more critical data than ever resides in cloud applications – from Salesforce and Google Workspace, to Box, Dropbox, and Microsoft 365. Eight Common SaaS Security Threats, from Account Takeover to Business Email Compromise
People (4)
Threat Actors (4)
MITRE ATT&CK (7)
Vendors (2)
Products (8)
Tools (1)
Industries (9)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.