Google data breach: the giant falls victim to ShinyHunters attacks via Salesforce

Google has just confirmed a major data breach after falling victim to a large-scale campaign of attacks by the ShinyHunters extortion group against the Salesforce instances of major companies.

The tech giant revealed on Tuesday that one of its corporate Salesforce instances had been targeted by threat actors in June, confirming this Google data breach as part of a campaign that has hit several large companies. The revelation comes just weeks after Google itself warned about these same attacks, showing that even the best-informed companies are not immune to these sophisticated vishing techniques.

The vishing technique used by UNC6040

Google Threat Intelligence Group (GTIG) tracks UNC6040, a financially motivated threat cluster that specialises in vishing campaigns specifically designed to compromise organisations’ Salesforce instances for large-scale data theft and subsequent extortion.

In these attacks, the threat actors posed as IT support staff in phone calls to targeted employees, trying to persuade them to visit Salesforce’s connected app setup page. Victims were then asked to enter a “connection code” that linked a malicious version of Salesforce’s Data Loader OAuth app to the target’s Salesforce environment.

Hijacking the Salesforce Data Loader

A prevalent tactic in UNC6040’s operations involves tricking victims into authorising a malicious connected app in their organisation’s Salesforce portal. This app is often a modified version of Salesforce’s Data Loader, not authorised by Salesforce.

In some cases, the Data Loader component was renamed “My Ticket Portal” to make it more convincing during the attacks. This particularly insidious technique exploits employees’ trust in their internal IT support and turns a legitimate Salesforce tool into an attack vector.

Its operators also pose as IT support, with the specific aim of tricking employees into navigating to Salesforce’s connected apps page and authorising an actor-controlled malicious version of the Data Loader app.

The impact of the Google data breach and the information compromised

The instance was used to store contact information and related notes for small and medium-sized businesses. The analysis showed that the data was retrieved by the threat actor during a small window of time before access was cut off.

Google stated that the data retrieved by the threat actor was limited to basic and largely publicly available business information, such as business names and contact details. Although the impact of this Google data breach is relatively limited, the intrusion shows how effective UNC6040’s techniques are.

The real identity behind UNC6040

Google classifies the threat actors behind these attacks as “UNC6040” or “UNC6240”. However, BleepingComputer, which has been following these attacks, learned that a notorious threat actor known as ShinyHunters is behind them.

It is plausible that the threat actor intends to sell the data rather than share it publicly. This approach would be in line with the ShinyHunters group’s previous activity. The group is also associated with “The Com”, a network of experienced English-speaking cybercriminals.

An escalation towards data leak sites

Google’s threat intelligence team believes that the threat actors using the ShinyHunters brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS). These new tactics would likely be intended to increase pressure on victims, including those linked to UNC6040’s recent Salesforce-related data breaches.

This tactical evolution is a significant threat for organisations, as data leak sites let attackers put additional public pressure on their victims.

The victims of the UNC6040 campaign

Other companies affected by these attacks include Adidas, Qantas, Allianz Life, Cisco and the LVMH subsidiaries Louis Vuitton, Dior and Tiffany & Co. Jewellery retailer Pandora also disclosed a data breach this week, and the company was reportedly a target of the same campaign.

The ransoms demanded

BleepingComputer learned that one company has already paid 4 bitcoins, around $400,000, to prevent its data from being leaked. This considerable sum shows the potential financial impact of these attacks on victim organisations.

UNC6040’s technical infrastructure

UNC6040 used infrastructure to access Salesforce applications that also hosted an Okta phishing panel. The panel was used to trick victims into visiting it from their mobile phones or work computers during the social engineering calls.

The infrastructure used by UNC6040 includes Mullvad VPN IP addresses and the Tor network to anonymise its access and exfiltration activities. This multi-layered approach shows the group’s technical sophistication, combining psychological manipulation techniques with advanced anonymisation tools.

Evolving exfiltration tactics

Not only have ShinyHunters’ tactics, techniques and procedures (TTPs) evolved and become more varied since last year, they have even changed since June. According to the 5 August update, UNC6040 now uses Mullvad VPN and Tor IP addresses and custom Python scripts instead of the modified Data Loader app.

Defence mechanisms against vishing

Protecting against these attacks requires a multi-layered approach combining technical controls and human awareness.

Hardening Salesforce configurations

To mitigate this threat, GTIG stresses the importance of a shared responsibility model and recommends a defence-in-depth strategy, starting with the principle of least privilege: strictly limit data access permissions, especially the “API Enabled” permission required by tools such as Data Loader.

Organisations must also implement rigorous management of connected apps, with a review and approval process for all external applications that connect to the Salesforce environment.

IP address-based restrictions

For organisations using Salesforce, Google recommends restricting “API Enabled” permissions, limiting authorisation to install apps and blocking access from commercial VPNs such as Mullvad.

Training and awareness

Mandiant recommends that organisations consider best practices to strengthen their external perimeter and develop secure communication channels, particularly those involving IT support and employee verification.

Train help desk staff to rigorously carry out positive identity verification for all employees before modifying accounts or providing security-sensitive information (including at initial enrolment).

The human factor in security

The effectiveness of social engineering campaigns relies on extensive reconnaissance. The decline of in-person social interaction and remote IT structures, such as outsourced help desks, have normalised employees dealing with external or less familiar staff.

This normalisation of remote work and outsourced services creates fertile ground for vishing attacks, making employees more likely to interact with people they have never met in person.

The industrialisation of vishing

Jason Soroko, senior fellow at Sectigo, explains that UNC6040 and ShinyHunters have industrialised voice phishing to get into the soft underbelly of third-party SaaS, where layered controls collapse as soon as an insider agrees to bypass them.

Lessons from the Google incident

The irony of the situation is not lost on security experts: Google published the playbook but still lost data, which shows that layered controls collapse once an insider agrees to get around them.

This Google data breach underlines that even the most advanced tech companies, with some of the best security teams in the world, remain vulnerable to sophisticated vishing attacks. The human factor remains the weakest link in the security chain, whatever an organisation’s level of technical sophistication.

The UNC6040 campaign perfectly illustrates how modern cyber threats are evolving, with attackers increasingly favouring psychological manipulation over technical exploits. Faced with this reality, organisations must rethink their security strategies, giving equal weight to the technical and human aspects of cybersecurity.

Google data breach: frequently asked questions