Salesloft Drift supply chain attack lands a devastating blow to tech and connected customers
This edition of the Bitdefender Threat Debrief covers several recent developments, including a supply chain attack, an offer made to Qilin and LockBit, a manufactured ransomware powerhouse, and more.
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time.
A Salesloft Drift supply chain attack with incidents dating back to early August has impacted more than 700 organizations worldwide with IT firms, MSSPs, Managed Security Service Providers, and their customers taking the brunt of these attacks.
The breaches have affected several data types, including unique customer information, support tickets, and credentials to access APIs and other services. Salesloft is a SaaS offering designed to manage sales and project management processes, while Drift is the chat agent that supports Salesloft functions, with the assistance of AI. Those using Drift alongside Salesloft and Drift’s integrated services were advised to disconnect Drift, reauthenticate with a new API key, and leave synchronization functions inactive.
The findings published from a recent investigation established that the Salesloft Drift supply chain attack started with a threat actor’s access to a GitHub account from March to June 2025. The threat actor extracted data from connected repositories, created a guest user account, and conducted reconnaissance on the Salesloft and Drift ecosystems. OAuth tokens were a key component of the supply chain attack. After conducting reconnaissance, the threat actor gained access to a Drift AWS environment and obtained the necessary tokens, which they used to locate data stored in Drift-integrated platforms.
Threat activity associated with the Salesloft Drift supply chain attack has been connected to the threat actor known as UNC6395. While a channel named after the Scattered Spider, LAPSUS$, and Shiny Hunters in late July claimed responsibility for the attack, these claims were lacking significant evidence to support that stance.
At the time of this debrief, there is, however, supporting information that the threat actor responsible for the supply chain attack is distinct from Scattered LAPSUS$ Hunters due to the method used to gain initial access to target systems and the scope of the attack.
Rather than rely on social engineering to enter an environment, the threat actor breaches a third-party software that integrates with multiple platforms, making the consequences of their breach far more extensive than for instance one affected group of machines or accounts. The outcome of such a compromise also differs from the tactics associated with Scattered LAPSUS$ Hunters, who prioritize extortion.
Customers, service providers, and vendors share a responsibility to secure applications and data. The Salesloft Drift supply chain attack also underscores the importance of maintaining mature risk assessment and incident response programs. It is imperative for teams to assess critical applications used in the environment in addition to the resources connected to those applications.
Access controls, including the enforcement of separation of duties and credential rotation, provide a barrier to protect against unauthorized users and devices. Finally, testing and continuously updating detection parameters for anomalous activity, including logons, new user/account additions, and data retrieval/removal, can help proactively enhance threat detection efforts to spot threat actor activity earlier.
Now, let’s explore the notable news and findings since the last Threat Debrief release.
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks.
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. This often means focusing on developed countries. Let’s see the top 10 countries that took the biggest hit from these attacks.
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to the consumer marketplace, or attack both. Here are the Top 10 industries that were hit by ransomware groups.
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here.
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This provides us with one of the industry’s most comprehensive real-time views of the evolving threat landscape.
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.