Attack Chain

1. An unauthorized entity gains initial access to Klue's integration layer, which facilitates connections between Klue and other SaaS platforms.
2. The unauthorized entity compromises an OAuth token used to establish and maintain the integration between Klue and Salesforce.
3. The compromised OAuth token is subsequently leveraged to gain unauthorized access to a specific portion of Recorded Future's Salesforce account.
4. Attackers navigate and access business data fields stored within the Salesforce database.
5. Specific customer contact names and email addresses are identified and accessed.
6. Potentially, business contract information stored in the Salesforce account is also accessed by the attackers.
7. The accessed sensitive customer and business data is likely exfiltrated from the Salesforce environment.

Impact

The security incident resulted in the unauthorized access to and potential exfiltration of sensitive business data from Recorded Future's Salesforce account. This data included customer contact names, email addresses, and potentially specific business contract information. While Recorded Future's core platforms, intelligence graph, and other internal infrastructure were not affected, the incident exposed a subset of their customer's contact information. This type of data exposure can lead to increased risks of targeted phishing campaigns, business email compromise (BEC) attacks, and other forms of social engineering against the affected individuals and organizations.

Recommendation

• Implement robust logging and monitoring for Salesforce activities to detect unauthorized access attempts or unusual data access patterns, given the compromise of a Salesforce account in this incident.
• Regularly audit and revoke OAuth tokens granted to third-party applications connecting to critical SaaS platforms like Salesforce, as a compromised OAuth token was the vector for unauthorized access in this event.
• Review third-party application integrations with Salesforce and other critical SaaS platforms to minimize the attack surface, considering Klue's role as a compromised third-party vendor in this incident.