The Golden Scale: 'Tis the Season for Unwanted Gifts
Summary: Unit 42 reports that Scattered LAPSUS$ Hunters returned after weeks of apparent inactivity, with Salesforce revoking all active access and refresh tokens tied to Gainsight-published applications on Nov. 20, 2025 after detecting unusual activity, and Bling Libra (ShinyHunters) claiming access to an additional 285 Salesforce instances via the Gainsight breach. Gainsight had acknowledged on Sept. 3, 2025 that it was breached through stolen OAuth tokens linked to the August 2025 Salesloft Drift supply chain attack, and on Nov. 24, 2025 it suspended connections to HubSpot and Zendesk and urged customers to rotate S3 keys.
Key Takeaway: The group claims a 2025 victim count of roughly 1,500 organizations and is developing ShinySp1d3r ransomware, while paying an insider $25,000 for access to CrowdStrike's network - a combination of stolen OAuth tokens, insider recruitment, and ransomware that reaches your data through the SaaS vendors you already trust.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026