Trending Articles
Trending Topics
Trending
AI-powered market research platform Klue describes its dynamic battlecards for sales teams as “an essential weapon for reps facing tough competition and savvy buyers”. Sadly, it has discovered that hackers also like the weapon analogy, with several of its customers falling victim to an attack through its integrated systems.
Although the actual extent of the attacks is yet to be determined, we know cybersecurity vendors are among them. One of the most notable is password manager LastPass, which has confirmed that the attackers were able to “access LastPass customer data within our Salesforce environment”. Data that may have included “customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data”.
The newly discovered Icarus ransomware and extortion group, first observed in the wild earlier this month, has claimed responsibility for the attack. “We advice (sic) Klue to contact us for a swift resolution, in order not to affect the companies you work with,” the group demanded, adding that if Klue didn’t “accommodate this request, we advice (sic) the companies who want to protect their data to contact us”.
Klue CEO Jason Smith has since released a statement to update customers on the incident, first identified on 12 June, when unauthorised activity was found in “a portion of Klue’s integration infrastructure”.
The attackers gained access “through a compromised legacy credential associated with an integration service,” Smith said, which I understand to be the Battlecards app, that then enabled attackers to “obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments”.
Salesforce, for its part, has said it has “disabled the connection between the Klue Battlecards app, installed by individual customers, and Salesforce as part of our response to a recent security incident.”
“There is no evidence that customer content stored within the Klue platform was impacted,” Smith said, adding that “specific remediation guidance has been shared directly with affected customers”.
LastPass has also contacted affected customers while confirming that “LastPass products, services, and infrastructure were not impacted in any way and customer vaults remain secure”.
Josh Picolet, VP of Detection & Analysis at Team Cymru, told me that the most important lesson from the Klue incident is that attackers are increasingly targeting the connective tissue between organisations rather than the organisations themselves.
“Third-party platforms often sit at the centre of large networks of trust,” Picolet said, “making them attractive targets because a single compromise can create downstream access to dozens or hundreds of victims.”
“Your security is now only as strong as the third-party apps you have granted standing access to your CRM,” Sunil Gottumukkala, CEO, at Averlo warned, “and most teams don’t actively track those integrations.”
I will leave the last words to Denis Calderone, CTO, Suzu Labs, who pointed out that there have now been three Salesforce OAuth supply chain attacks in under a year, from two different threat actors, using the same playbook.
“At this point, we have to accept that this particular attack pattern has been successfully commoditised,” he said.
In terms of mitigation? “If you’re a Klue customer, rotate every OAuth token tied to that integration, and don’t limit yourself to Salesforce. If Klue had an OAuth connection into your Slack, your Google Drive, or anything else, treat those tokens as compromised and rotate them now.”
The real takeaway here, though, is that every organisation must audit all connected apps for any dormant integration credentials, paying particular attention to automating alerts for abnormal API query volumes from third-party services.
“If a connected app that normally syncs a few hundred records starts pulling thousands of queries in minutes,” Calderone concluded, “that’s your early warning.”
