Cybersecurity Firms Impacted by Klue Supply Chain Attack

1. Executive summary

Between 11–17 June 2026, threat actors compromised the backend of Klue, a market-intelligence platform that integrates with multiple SaaS systems, and pushed an unauthorised code update designed to harvest OAuth tokens for customer integrations. Stolen tokens were then used to call the Salesforce REST API and exfiltrate CRM data over a ~24-hour window, with ReliaQuest observing a concentrated burst of nearly 1,000 queries in 15 minutes and sustained extraction windows exceeding 6 hours. Confirmed victims to date are cybersecurity vendors Huntress and Recorded Future; both state the impact was limited to business/CRM data (contacts, quotes, contract metadata) and did not touch their core product, telemetry or threat-data estates. The pattern mirrors prior Salesloft Drift and Gainsight supply-chain incidents, but Huntress assesses a new actor — "Icarus" / "Mr Brean" — is responsible; this attribution is unconfirmed as no MITRE profile exists for the group in our reference data. For EMEA financial-services firms that use Klue (or comparable sales-intelligence tools) the immediate risk is CRM-resident client and deal data leakage, and a secondary risk that any other SaaS integration token issued by Klue (HubSpot, Slack, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive) could be replayed against those tenants.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (per Huntress, ReliaQuest and SecurityWeek reporting)

1. Initial access — Klue backend. On 11 June 2026, attackers connected to Klue's backend servers and executed unauthorised commands. The exact access vector (credential abuse, vulnerability, or insider) is not publicly disclosed.
2. Malicious code update. Attackers pushed a code update to Klue designed to harvest OAuth tokens issued to customers for Klue's integrations.
3. Token harvesting. The update captured OAuth tokens for the integrations Klue supports: Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack.
4. Pivot via Salesforce REST API. Harvested tokens were used to call the Salesforce REST API against customer tenants.
5. Mass data exfiltration. Over a ~24-hour window, attackers issued high-volume queries against Salesforce. ReliaQuest observed a concentrated burst of ~1,000 queries in 15 minutes and sustained extraction windows of >6 hours.
6. Containment by Klue. On 12 June, Klue deactivated OAuth tokens for all customers and disabled the listed integrations.
7. Containment by Salesforce. On 17 June, Salesforce disabled the Klue Battlecards app integration and notified customers of "unusual activity" via the app's connection to Salesforce.
8. Victim disclosure. On 18 June, Huntress published a detailed account; Recorded Future confirmed impact on the same day.
9. Extortion contact. Huntress reports receiving an attempted extortion communication from a threat actor calling itself "Mr Brean", pointing to a Session Messenger ID associated with the Icarus extortion group (first observed April 2026).

Technical specifics relevant to defenders

• Compromised component: Klue's backend code-update pipeline and the OAuth tokens it issues for downstream SaaS integrations. The compromise was on Klue's side, not on customer infrastructure.
• API abused: Salesforce REST API. Defenders should review REST API logs (/services/data/..., /services/data/vXX.X/query/?q=...) for the affected window.
• Behavioural signature: high query rate from a single source/IP against Salesforce REST endpoints, with sustained bursts rather than steady traffic.
• Data scope exfiltrated (Huntress, Recorded Future statements): business contacts, price quotes, sales-related messaging, client contact names and email addresses, and some business contract information. Not affected: threat data, passwords, payment card data, engineering data, agent/telemetry pipelines.
• Blast radius: limited to the Klue–Salesforce integration; attackers did not access systems owned or maintained by Huntress or Recorded Future directly.
• Persistence / lateral movement: none publicly reported inside victim environments; the attack pattern is "use stolen token, query API, exfiltrate, exit".

Caveated / unconfirmed claims

• Attribution to "Icarus" / "Mr Brean" rests on Huntress's high-confidence assessment based on a Session Messenger ID and Icarus's leak-site entries (early May and 16 June). No MITRE profile exists for Icarus in our reference data; treat this attribution as unconfirmed. The pattern overlaps with prior ShinyHunters / UNC6395 activity but is assessed as a distinct actor.
• Klue has not publicly commented; details of the initial-access vector and the exact code-update payload are not in the public sources.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory exposure. Identify any business unit, subsidiary or third-party using Klue, Klue Battlecards, or any of the affected integrations (Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, Slack).
2. Rotate and revoke tokens. Rotate OAuth tokens, API keys and refresh tokens for every Klue-issued integration in your tenant. Revoke any active Salesforce session tokens issued via Klue and force re-authentication of users.
3. Disable the Klue Battlecards app in Salesforce (Setup → Connected Apps → App Exchange → Klue Battlecards → Uninstall/Block) and any other Klue-connected app until Klue confirms the code-update pipeline is clean.
4. Block Klue backend egress at the network egress proxy for any system that does not require it; allow-list only after vendor confirmation.
5. Preserve evidence. Snapshot Salesforce Event Monitoring, REST API logs, and any web/proxy logs covering 11–17 June 2026 before retention rotates.

P2 — within 72 hours

6. Review Salesforce REST API logs for the 11–17 June window for: high query rates (>100/min sustained), queries against Account, Opportunity, Contact, Lead, Contract objects, and any source IP not previously associated with Klue.
7. Audit data egress. Search for anomalous SELECT queries returning large result sets, especially Email, Phone, Contract__c, custom CRM objects.
8. Vendor risk review. Open a formal ticket with Klue requesting: (a) root-cause statement, (b) confirmation the malicious code update has been reverted and the build pipeline re-secured, (c) list of all tokens rotated, (d) SOC 2 / ISO 27001 evidence for the affected systems.
9. Concentration-risk review. Record Klue as a concentration-risk dependency per DORA Art. 29; evaluate alternatives or compensating controls (manual CRM enrichment, alternate sales-intel vendor).

P3 — within 7 days

10. Contractual review. Verify DORA Art. 30 / NIS2 Art. 21(2)(d) clauses with Klue: right to audit, incident notification SLA, exit assistance, subcontractor flow-down.
11. Detection tuning. Deploy the Sigma rule in §6 across SIEM; tune thresholds to your tenant's normal Salesforce API volume.
12. User awareness. Brief sales, SDR and RevOps teams on the incident; instruct them to report any unsolicited contact referencing Klue, Salesforce data, or "Mr Brean" / Icarus extortion.
13. Tabletop. Run a short scenario exercising DORA Art. 19 / NIS2 Art. 23 reporting timelines against this incident class.

5. Indicators of compromise

threat-actor  Icarus
threat-actor  Mr_Brean
vendor        Klue
app           Klue_Battlecards
api           Salesforce_REST_API
integration   Salesforce
integration   HubSpot
integration   SharePoint
integration   Zoom
integration   Gong
integration   Chorus
integration   Clari
integration   Google_Drive
integration   Slack

6. Detection

Sigma rule — high-volume Salesforce REST API queries (proxy / WAF / Salesforce Event Monitoring)

title: High-volume Salesforce REST API queries consistent with Klue supply-chain exfiltration
id: AT-2026-06-19-131-001
status: experimental
description: |
  Detects bursts of Salesforce REST API queries consistent with the Klue
  supply-chain attack pattern (~1,000 queries in 15 minutes, sustained
  extraction windows >6 hours). Tune thresholds to tenant baseline.
author: Adverse Trace
date: 2026-06-19
references:

  - https://www.securityweek.com/cybersecurity-firms-impacted-by-klue-supply-chain-attack/
logsource:
  product: web
  category: proxy
detection:
  selection_sf_rest:
    cs-uri-query|contains:

      - "/services/data/"
      - "/services/data/v"
      - "/services/data/vXX.X/query"
    cs-host|endswith:

      - ".salesforce.com"
      - ".force.com"
      - "my.salesforce.com"
  selection_burst:
    RequestCount|gt: 100
    TimeWindowMinutes: 15
  condition: selection_sf_rest and selection_burst
fields:

  - c-ip
  - c-user
  - cs-uri-stem
  - sc-status
falsepositives:

  - Bulk data migrations or backfills by internal data team
  - BI/analytics tools pulling large CRM extracts
level: high
tags:

  - attack.exfiltration
  - attack.t1530
  - supply_chain

YARA rule: Insufficient file-based indicators in the source material to author a YARA rule. The behavioural indicator above is the primary detection.

7. Sources

• SecurityWeek — Cybersecurity Firms Impacted by Klue Supply Chain Attack — https://www.securityweek.com/cybersecurity-firms-impacted-by-klue-supply-chain-attack/ — 19 Jun 2026
• Help Net Security — Klue breach lead to Salesforce data theft, Huntress affected — https://www.helpnetsecurity.com/2026/06/19/klue-salesforce-data-breach-huntress/ — 19 Jun 2026
• Huntress — incident writeup (referenced via SecurityWeek/Help Net Security, 18 Jun 2026)
• ReliaQuest — technical analysis (referenced via SecurityWeek, June 2026)

8. Adverse Trace position

Severity: moderate. The compromise is on a third-party (Klue) rather than in-scope firm infrastructure, the exfiltrated data is CRM/business data rather than core financial or threat-intelligence data, and containment actions (token revocation, app disable) have already been taken by Klue and Salesforce. However, the pattern — code-update pipeline compromise → OAuth token theft → SaaS REST API exfiltration — is now the third such incident in the Salesforce/Salesloft/Gainsight family, and any firm using Klue or a comparable sales-intel tool should treat this as a P1 third-party risk event. Next steps for Adverse Trace: (1) push the Sigma rule to all managed SIEM tenants; (2) open a vendor-risk case against Klue requesting root-cause and pipeline-security evidence; (3) monitor for Icarus extortion contact against any EMEA FS client and escalate immediately if observed; (4) re-assess if Klue issues a public post-mortem or if additional victims disclose.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.