{
  "Event": {
    "analysis": "1",
    "date": "2026-06-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Klue Integration Abused in Salesforce Data Theft | Threat Spotlight",
    "protected": false,
    "publish_timestamp": "1782364304",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782364303",
    "uuid": "eb6c5ce1-e012-43a3-abcd-737099a4de83",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"ReliaQuest\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#f146c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sharepoint - T1213.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#91c667",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Cloud Storage - T1530\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838033",
        "to_ids": false,
        "type": "link",
        "uuid": "13550647-8453-4a00-a634-8149ba595b0e",
        "value": "https://reliaquest.com/blog/threat-spotlight-integration-abused-in-crm-data-theft"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838033",
        "to_ids": false,
        "type": "text",
        "uuid": "e6696845-b42f-45b0-bda1-60024953a439",
        "value": "In June 2026, a compromised Klue competitive-intelligence platform integration was exploited to exfiltrate customer relationship management data from enterprise Salesforce environments. Attackers authenticated through compromised Klue service accounts, generated OAuth tokens, and executed automated Python scripts to conduct bulk data extraction via Salesforce REST API queries over approximately 24 hours. The activity included concentrated bursts of nearly a thousand queries within 15 minutes and sustained extraction windows exceeding 6 hours. This incident follows similar third-party OAuth-abuse campaigns targeting Salesforce through Salesloft Drift and Gainsight integrations throughout 2025 and 2026. While the tactics resemble operations attributed to ShinyHunters and UNC6395 threat groups, attribution remains uncertain. The initial access vector, full scope of exfiltration, and attacker intent are still under investigation, with no extortion demands observed to date."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838033",
        "to_ids": false,
        "type": "text",
        "uuid": "63caa79b-5071-4bd5-bd06-83ea3f2efdf7",
        "value": "Name: Klue Integration Abused in Salesforce Data Theft | Threat Spotlight\nAuthor: AlienVault\nAdversary: \nTags: [\"salesforce\", \"unc6395\", \"oauth abuse\", \"api exfiltration\", \"third-party integration\", \"klue integration\", \"shinyhunters\", \"crm data theft\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1213.002\", \"T1119\", \"T1530\", \"T1106\", \"T1567\", \"T1087\", \"T1102\", \"T1528\", \"T1041\", \"T1078\", \"T1567.002\", \"T1059.006\", \"T1213\", \"T1071.001\", \"T1550.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782358014",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "49a72885-116a-466c-ba5a-a37254e16ebc",
        "value": "212.86.125.24",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782358035",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e54cefd2-67db-4d98-8451-525cb7ad3900",
        "value": "94.154.32.160",
        "Tag": [
          {
            "colour": "#df602d",
            "local": false,
            "name": "asn:asn=\"210538\"",
            "relationship_type": ""
          },
          {
            "colour": "#9feb61",
            "local": false,
            "name": "asn:as-owner=\"KEYUBU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c8c8d",
            "local": false,
            "name": "asn:as-country=\"TR\"",
            "relationship_type": ""
          },
          {
            "colour": "#ae20ff",
            "local": false,
            "name": "misp-galaxy:country=\"turkey\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782358056",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f24cb8fa-3cc1-4294-8a20-1fb80a763004",
        "value": "138.226.246.94",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782358077",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0a080292-2604-42e3-b9b5-1079996dfbeb",
        "value": "213.111.148.90",
        "Tag": [
          {
            "colour": "#3eb970",
            "local": false,
            "name": "asn:asn=\"6698\"",
            "relationship_type": ""
          },
          {
            "colour": "#e4d5aa",
            "local": false,
            "name": "asn:as-owner=\"VIRTUALSYSTEMS\"",
            "relationship_type": ""
          },
          {
            "colour": "#02bf45",
            "local": false,
            "name": "asn:as-country=\"UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8651e1",
            "local": false,
            "name": "misp-galaxy:country=\"ukraine\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}