Salesforce Targets Bandits in Crackdown: Arrests and Seizures Reported by The Register

cybercrime Group Scattered Lapsus$ Hunters Announces Temporary Shutdown, Threatens Retaliation

The Scattered Lapsus$ Hunters (SLSH), a notorious cybercrime collective primarily composed of individuals in their teens and twenties, has declared a temporary cessation of operations until 2026. This announcement follows the Federal Bureau of Investigation’s seizure of the group’s publicly accessible website.

In a communication consistent with their past behaviour, the group released a profanity-laced and aggressive message via Telegram. The message urged its followers to continue targeting organizations that decline to meet ransom demands and explicitly promised a retaliatory cyberattack against the FBI when they resume activity.

“As per the exceptional circumstances by which the FBI tried to obliterate our legacy,we’ve exceptionally decided to temporarily renounce to oblivion and promptly hack them back,” a member purportedly wrote on October 11th.”We shall now dissolve again in the ether. Good night.”

A subsequent message intensified the threat, stating, “I promise you, you will feel our wrath.” The group concluded with a vow to seek the dismissal of Brett Leatherman, the head of the FBI’s cyber division, when they reactivate next year.

A History of False Starts

This is not the first time SLSH has announced a pause in its illicit activities. Just last month,the group initially stated it was ceasing operations,only to resume its attacks three days later. This pattern casts doubt on the longevity of their current announced hiatus.

Unique Profile of the Group

SLSH has gained notoriety for the breadth of its targets and its unusual demographic.Unlike most cybercrime organizations, SLSH’s members are overwhelmingly from western countries and are native English speakers. This distinction sets them apart from many other threat actors, who often originate from Eastern Europe or Asia.

The collective was formed earlier this year, consolidating key personnel from scattered Spider, Lapsus$, and Shiny Hunters. This amalgamation quickly drew intense scrutiny from law enforcement agencies worldwide.

Recent Arrests and investigations

Authorities have made important strides in apprehending suspected members. In September,the National Crime Agency in the United Kingdom arrested and charged two teenagers,Owen Flowers,18,and Thalha Jubair,19,in connection with an attack on Transport for London. Thes arrests represent a rare instance of authorities publicly linking individuals to the Scattered Spider group.

Earlier in July, four individuals were arrested in the UK regarding attacks on prominent British retailers, including Co-op, Marks & Spencer, and Harrods. while Scattered Spider was suspected in at least two of these incidents, authorities did not formally confirm the connection.

Recent Data Leaks and Claims

Over the weekend, SLSH further escalated tensions by leaking data from several major corporations, including Qantas, Vietnam Airlines, Gap, and Fujifilm. Though, links to the stolen data hosted on Limewire were quickly removed by the platform itself.

Qantas has publicly acknowledged the breach and secured a Supreme Court injunction to prevent unauthorized access to the compromised data. The airline reported in July that approximately 6 million customers had their personal information and frequent flyer numbers exposed, emphasizing the need for vigilance against potential scams.

Third-party data breach monitoring services have corroborated some of SLSH’s claims. HaveIBeenPwned confirmed the Vietnam Airlines dataset contained details of 7.3 million customers, while Atlas Privacy’s databreach.com verified that the Gap leak included information on 256,200 email addresses, 152,100 phone numbers, and 146,100 home addresses.

SLSH alleges it also obtained data from 40 additional companies through an attack on a Salesforce plugin, Salesloft. However, Salesforce maintains that its own systems were not compromised.

The group has suggested that companies which did not have their data leaked had paid a ransom. Security experts, however, caution against accepting these claims at face value, citing a pattern of exaggeration and false statements from the group.

Such as, SLSH previously claimed to have stolen data from Australian telecommunications provider Telstra, alleging a compromise of 19 million customer records. telstra refuted this claim, stating the data was scraped from public sources and did not include sensitive information like passwords or financial details.

Intimidation Tactics and Future Concerns

According to Jon Abbott, CEO of ThreatAware, the recent data leaks are primarily intended to intimidate potential victims into paying ransom demands. “Last week’s extortion attempt and the data leak on Saturday are indicators that the 40 companies did not pay the group,” Abbott explained.He further warned customers of affected companies to remain vigilant against potential phishing and identity theft schemes.

Abbott emphasized that fundamental cybersecurity practices are the most effective defense against such threats. “Paying criminals offers no guarantee, but doing the security basics does. Scattered Lapsus$ Hunters’ tactics, including vishing and modified data loaders, highlight the need for rigorous password reset verification, hardened service desk processes, and exceptional cyber hygiene.”

Understanding the Evolving Threat Landscape

The tactics employed by groups like Scattered lapsus$ Hunters exemplify a shift in the cybercrime landscape. Increasingly, attackers are leveraging social engineering and readily available tools to exploit vulnerabilities. According to the Verizon 2024 Data Breach Investigations Report, phishing remains one of the most common vectors for prosperous attacks, accounting for over 70% of breaches.

Threat Actor	Typical Targets	Common Tactics	Geographic Origin
Scattered Lapsus$ Hunters	Large Corporations, Transportation, Retail	Data Theft, Extortion, Social Engineering	Western Countries
Ransomware Groups (e.g., LockBit)	Critical Infrastructure, Healthcare	Encryption, Data exfiltration, Ransom Demands	Eastern Europe, Russia
Nation-State Actors	Government, Defense, Intellectual Property	Espionage, Sabotage, Data Theft	Various (China, Russia, Iran, North Korea)

Did You know? The average cost of a data breach in 2023 was $4.45 million according to IBM’s Cost of a Data Breach Report.

Frequently asked Questions About scattered Lapsus$ Hunters

What are your thoughts on the increasing boldness of cybercrime groups? Do you beleive that current cybersecurity measures are sufficient to protect against these threats?

Share your comments below and help us build a more informed discussion on cybersecurity.

What specific API vulnerabilities were exploited in the Salesforce security breach, according to the report?

Recent reports from The Register detail a meaningful crackdown by Salesforce against individuals exploiting vulnerabilities within its platform for malicious gain. This operation, focused on dismantling groups engaged in unauthorized access and data scraping, has resulted in multiple arrests and the seizure of illicitly obtained data. This article dives into the details of the Salesforce security breach,the methods used by the perpetrators,and the implications for Salesforce users and the broader cloud security landscape.

Understanding the Salesforce Security Breach

The core of the issue revolves around unauthorized access to Salesforce data, achieved through various methods including credential stuffing, phishing attacks, and exploitation of API vulnerabilities. Thes “bandits,” as The Register terms them, weren’t simply looking for data; they were actively selling access and scraped data on the dark web.

* Credential Stuffing: Utilizing compromised username/password combinations obtained from other breaches.

* Phishing Attacks: Deceptive emails designed to trick users into revealing thier Salesforce login credentials.

* API Exploitation: Leveraging weaknesses in Salesforce’s Application Programming Interfaces (APIs) to bypass security measures.

* Data Scraping: Automated extraction of large volumes of data from Salesforce instances.

The targeted data included sensitive customer information, sales leads, and proprietary business data, posing a significant risk to Salesforce customers. the scale of the operation suggests a sophisticated and organized effort, indicating these weren’t isolated incidents. Salesforce security incidents are becoming increasingly common, highlighting the need for robust security measures.

The Arrests and Seizures: What We Know

While Salesforce and law enforcement agencies have been tight-lipped about specific details, The Register reports that arrests have been made in multiple jurisdictions.The seizures included servers hosting the stolen data, as well as tools used to facilitate the attacks.

* International Cooperation: The investigation involved collaboration between law enforcement agencies in the US, Europe, and Asia.

* Data Recovery: Efforts are underway to recover and return the stolen data to its rightful owners.

* Ongoing Investigation: The crackdown is ongoing, with authorities continuing to identify and apprehend individuals involved in the scheme.

* Charges Filed: Individuals face charges ranging from computer fraud and abuse to data theft and conspiracy.

The swift action taken by Salesforce and law enforcement signals a zero-tolerance policy towards those attempting to exploit the platform. This proactive approach is crucial for maintaining trust and confidence in Salesforce’s security capabilities.

Impact on Salesforce Users: What You Need to Do

This incident serves as a stark reminder for all Salesforce users to prioritize security. Here’s a breakdown of essential steps to protect your data:

1. Enable Multi-Factor Authentication (MFA): This adds an extra layer of security, making it significantly harder for attackers to gain access even with compromised credentials. Salesforce MFA is a critical security control.
2. Strong Password Policies: Enforce strong,unique passwords for all users and regularly rotate them. Consider using a password manager.
3. Review API Access: Regularly audit and restrict API access to only authorized applications and users. Minimize API exposure.
4. Employee Training: Educate employees about phishing scams and other social engineering tactics. Regular security awareness training is vital.
5. Monitor Login Activity: Utilize Salesforce’s security features to monitor login activity and identify suspicious behavior. Look for unusual login locations or times.
6. Data Encryption: Implement data encryption both in transit and at rest to protect sensitive information. Salesforce Shield is a valuable tool for this.
7. Regular Security Assessments: Conduct regular security assessments and penetration testing to identify and address vulnerabilities.

salesforce’s Response and Future Security Measures

Salesforce has publicly stated its commitment to enhancing security measures and protecting customer data. beyond cooperating with law enforcement, the company is implementing several key changes:

* Enhanced Threat Detection: Investing in advanced threat detection technologies to identify and respond to malicious activity in real-time.

* Improved API Security: Strengthening API security protocols to prevent unauthorized access.

* Increased Security Audits: Conducting more frequent and complete security audits of its platform.

* Bug Bounty Program: Expanding its bug bounty program to incentivize security researchers to identify and report vulnerabilities.

* Proactive Vulnerability Management: Implementing a more proactive approach to vulnerability management, including faster patching and remediation.

These measures demonstrate Salesforce’s commitment to addressing the