Data Is the New Diamond: Latest Moves by Hackers and Defenders
Summary: Unit 42 reports that the Salesloft Drift supply chain attack on Salesforce instances, attributed by Google to UNC6395, may trace back to March 2025 reconnaissance and targets Account, Contact, Case and Opportunity records to steal credentials and data. Threat actors claiming ties to Muddled Libra and Bling Libra have opened Telegram channels labeled "Scattered LAPSUS$ Hunters," boast of retail data theft extortion, and claim a forthcoming RaaS called "ShinySpider" with asserted encryption speeds of one GB per second.
Why it matters: One Muddled Libra member was recently sentenced to 10 years in federal prison and ordered to pay more than $13 million in restitution, yet the copycat dynamic Unit 42 describes means other Com-affiliated actors are likely to adopt the same playbook if it proves sustainable. Salesforce's move this month to restrict uninstalled connected applications closes one path, but Unit 42 expects actors to shift to other third-party platforms for data theft extortion.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026