{
  "Event": {
    "analysis": "1",
    "date": "2026-06-22",
    "extends_uuid": "",
    "info": "[Threat Intel] Detecting the Klue supply chain attack in Salesforce instances",
    "protected": false,
    "publish_timestamp": "1782454621",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782454621",
    "uuid": "a29c845d-27d7-4dfc-894b-2371d5fbafa1",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#f146c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sharepoint - T1213.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#cfba47",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#12d28f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1087.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#1acf09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Transfer Size Limits - T1030\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Datadog\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782212407",
        "to_ids": false,
        "type": "link",
        "uuid": "a909a17e-56de-4c07-b0b6-4500fc25547d",
        "value": "https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782212407",
        "to_ids": false,
        "type": "text",
        "uuid": "a17ab4e1-3ec0-4ec8-a08e-e0486ec0e7ed",
        "value": "On June 11, 2026, the Icarus threat group compromised Klue's backend systems, a market intelligence platform used by hundreds of enterprises to sync competitive battlecard data with CRM environments. The attackers exploited a dormant credential from an abandoned prototype integration to harvest OAuth tokens for Salesforce and Gong. Through automated API calls using Python scripts, the group exfiltrated CRM data including business contacts, price quotes, and sales communications from multiple customer Salesforce organizations. Klue detected the anomalous activity on June 12 and revoked OAuth credentials on June 13. The attackers subsequently launched an extortion campaign starting June 16, demanding victims contact them via Session Messenger within 48 hours."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782212407",
        "to_ids": false,
        "type": "text",
        "uuid": "553b51dc-de97-40af-a851-d7a6d48e5df6",
        "value": "Name: Detecting the Klue supply chain attack in Salesforce instances\nAuthor: AlienVault\nAdversary: Icarus\nTags: [\"klue compromise\", \"extortion campaign\", \"crm data theft\", \"salesforce\", \"supply chain attack\", \"oauth abuse\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1213.002\", \"T1567\", \"T1020\", \"T1528\", \"T1087.004\", \"T1041\", \"T1199\", \"T1114.002\", \"T1030\", \"T1213\", \"T1071.001\", \"T1550.001\", \"T1078.004\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782212407",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "1829248e-46c1-4998-b3ef-168a7b960350",
        "value": "Icarus"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447122",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "69ad8e20-03c9-4f73-a670-5efd93ac046c",
        "value": "138.226.246.94",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447143",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "300a3e6e-f532-4107-a805-28ed12399115",
        "value": "212.86.125.24",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447164",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3e951d10-7964-4023-9621-fc55b59ff419",
        "value": "94.154.32.160",
        "Tag": [
          {
            "colour": "#df602d",
            "local": false,
            "name": "asn:asn=\"210538\"",
            "relationship_type": ""
          },
          {
            "colour": "#9feb61",
            "local": false,
            "name": "asn:as-owner=\"KEYUBU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c8c8d",
            "local": false,
            "name": "asn:as-country=\"TR\"",
            "relationship_type": ""
          },
          {
            "colour": "#ae20ff",
            "local": false,
            "name": "misp-galaxy:country=\"turkey\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447185",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7f51ac44-6bd6-4ca6-afce-3603eda3a042",
        "value": "213.111.148.90",
        "Tag": [
          {
            "colour": "#3eb970",
            "local": false,
            "name": "asn:asn=\"6698\"",
            "relationship_type": ""
          },
          {
            "colour": "#e4d5aa",
            "local": false,
            "name": "asn:as-owner=\"VIRTUALSYSTEMS\"",
            "relationship_type": ""
          },
          {
            "colour": "#02bf45",
            "local": false,
            "name": "asn:as-country=\"UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8651e1",
            "local": false,
            "name": "misp-galaxy:country=\"ukraine\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}