eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Compromised npm Packages Lead to Large-Scale Supply Chain Attack
Bottom Line: A large scale npm package compromise was uncovered, impacting over 500 packages, resulting in the deployment of the "Shai Hulud" worm that automatically creates GitHub actions for data exfiltration through webhook sites, steals and publicly publishes secrets to GitHub, and makes private repositories public.
On September 15th, 2025, Socket and StepSecurity published reports on a newly observed Node Package Manager (npm) supply chain attack, which was reported to impact over 40 npm packages. One of the packages initially involved, ‘tinycolor’, has over 2.2 million weekly downloads. The compromised npm packages result in a worm, dubbed Shai Hulud, being used to steal secrets and publish them to GitHub, along with self-propagating capabilities to infect other npm packages that are owned by the compromised maintainer.
On September 16th, 2025, Aikido published a report on the same supply chain attack, but indicated that at the time that the article was published, the Shai Hulud worm had spread to an additional 147 npm packages, including npm packages related to CrowdStrike. Aikido linked the attack to a previous npm package compromise involving Nx on August 27th, 2025. By September 18th, 2025, reports indicated that over 500 npm packages had been compromised by the Shai Hulud worm. Trend Micro states that npm packages “impacted by this attack are those with extremely high global download rates – over 2.6 billion per week – affecting a vast ecosystem of web applications and dependent projects.”
Upon execution, Shai Hulud downloads and executes TruffleHog, which is an open-source security tool used to scan Git repositories and file systems to detect leaked secrets, such as API keys, passwords, and tokens. Targeted information includes GitHub personal access tokens, AWS access keys, Google Cloud Platform (GCP) service credentials, Azure credentials, Cloud metadata endpoints, and npm authentication tokens. Once data is collected, the worm creates a repository named Shai-Hulud under the compromised account and commits a JSON dump that contains the leaked secrets, publishing stolen data into a public GitHub repository. The worm also self-propagates through npm, by fetching existing packages, modifying them by injecting a malicious script, and repacking and publishing them, enabling “automatic trojanization of downstream packages”. The malware also features capabilities to iterate a compromised user’s accessible GitHub repositories and make them public or add additional workflows or branches to trigger additional leaks.
eSentire Threat Intelligence Analysis:
Analysis of the Shai Hulud worm indicates that it self-propagates, by infecting npm packages that are controlled by compromised maintainers. Given reports stating that there were initially 40 compromised packages, to over 500 within a few days, it is likely that the number of impacted packages will continue to grow, and that the ramifications of this attack will continue to be observed in the future. Reports indicate that the threat actors utilized a free webhook[.]site account as a means for exfiltrating stolen data but hit a request limit imposed on the free account. While this is unverified, if true, it could suggest that the impact of the attack had potential to be far greater. This attack is notable, as it is the second large-scale npm supply chain attack in September 2025. The first attack, observed on September 8th, 2025, involved compromised npm packages being used to deploy a web browser-based interceptor, used to hijack cryptocurrency related transactions on infected hosts and redirect them to attacker-controlled wallets. Given the impact of these attacks, eSentire's Threat Intelligence team assesses that supply chain attacks involving npm packages will likely continue to be used as an attack vector in the future.
Aikido claims that this supply-chain attack appears to have been perpetrated by the same threat actor behind another npm supply chain attack, observed in August 2025. This attack involved the compromise of npm packages related to Nx, which resulted in the harvesting and publishing of sensitive data to public GitHub repositories. The difference in this attack appears to be the lack of self-propagation by the malware, and no references to Shai Hulud within the code or leaked data. If these campaigns are related, based on the advanced capabilities of the worm, this would suggest that a technically skilled threat actor may be behind the attacks, who is able to rapidly evolve their Tactics, Techniques, and Procedures (TTPs) within a short timeframe.
Organizations should review a list of reported on npm packages that have been compromised. If any are found, they should be removed and replaced, all packages in the repository should be reinstalled, and all credentials should be rotated. Organizations should also follow the OWASP npm Security Best Practices guide, along with implementing robust Software Bill of Materials (SBOM) tracking to maintain visibility into software supply-chain dependencies. eSentire published an advisory on September 16th, 2025, providing additional information, recommendations, and mitigation steps for organizations that may have been impacted by this supply-chain attack.
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks
Bottom Line: The FBI issued a flash alert on September 12th, 2025, detailing cybercriminal activities by threat actors UNC6040 and UNC6395 targeting Salesforce. These groups utilized social engineering and exploited stolen tokens to exfiltrate sensitive data for extortion.
On September 12th, 2025, the United States’ Federal Bureau of Investigation (FBI) released a flash alert outlining Indicators of Compromise (IoCs) and describing various initial access methods used by threat actors to breach the Salesforce platform in recent campaigns. These include a voice phishing (vishing) campaign targeting Salesforce data attributed to threat actor UNC6040, and a data theft operation exploiting compromised OAuth tokens from Salesloft Drift, a third-party Salesforce integration.
UNC6040 has been conducting a vishing campaign since October 2024, with threat actors posing as IT support staff to address enterprise-wide connectivity issues. The attackers tricked users into authorizing a malicious connected app to their organization’s Salesforce portal. This app, a modified version of Salesforce’s Data Loader, gave UNC6040 extensive capabilities to access, query, and exfiltrate sensitive data from the compromised Salesforce environments. In some cases, victims were redirected to phishing pages to steal their credentials, allowing threat actors to use API queries to exfiltrate large volumes of Salesforce data. After gaining access, UNC6040 threat actors created malicious applications using Salesforce trial accounts, enabling them to register connected apps. Some victims reportedly received extortion emails months after the compromise, demanding cryptocurrency ransom in exchange for the exfiltrated data, allegedly from the ShinyHunters group.
In August 2025, another widespread Salesforce data theft was observed, with UNC6359 threat actors exploiting compromised OAuth tokens from Salesloft Drift, an AI chatbot integration with Salesforce. Through this third-party integration, UNC6359 accessed Salesforce instances to steal sensitive credentials, including AWS access keys (AKIA), passwords, and Snowflake-related tokens. On August 20th, 2025, Salesloft, in coordination with Salesforce, revoked all active access and refresh tokens for the Drift application, cutting off any threat actor access to affected Salesforce platforms. Salesloft confirmed that customers not using the Salesforce integration were unaffected by this campaign.
eSentire Threat Intelligence Analysis:
Salesforce serves as a critical hub for an organization’s operations as a Customer Relationship Management (CRM) platform, centralizing customer data, marketing, and business growth activities. Its ability to integrate with third-party applications further streamlines daily tasks. Data theft campaigns by UNC6040 and UNC6359 do not exploit inherent Salesforce vulnerabilities; instead, they leverage social engineering and third-party integration features to compromise instances, seeking the easiest routes to access large volumes of sensitive data. These campaigns have resulted in widespread data breaches impacting numerous organizations, including Zscaler, Palo Alto Networks, Proofpoint and more.
UNC6040 was first reported by Google in June 2025, where the financially motivated threat actors demonstrated advanced social engineering skills, deep knowledge of Salesforce’s cloud infrastructure, and effective defense evasion techniques. In August 2025, Google confirmed that its Salesforce instance was compromised by similar UNC6040 activity. According to Google, the stolen data primarily consisted of publicly available business information. Extortion emails in this campaign were allegedly sent by a second threat actor claiming to be the ShinyHunters group, but neither Google’s report nor the FBI alert confirmed this attribution. Google, however, tracks the threat actor under the name UNC6240.
Google reported on the Salesforce Salesloft Drift data breach by UNC6395 on August 26th, 2025. During the investigation, Mandiant confirmed that attackers accessed Salesloft’s GitHub account between March and June 2025, allowing them to download multiple repositories, create guest accounts, and set up workflows. In a statement to Bleeping Computer, the ShinyHunters group claimed responsibility, asserting they had stolen the Drift OAuth token and exfiltrated roughly 1.5 billion data records from 760 companies on the Salesforce platform. To support their claim, the group shared a text file listing the source code folders from the breached Salesloft GitHub repository.
ShinyHunters is a financially motivated threat group that gained prominence in 2020 through large-scale data breaches and extortion campaigns targeting major global brands. Its activity declined in 2024 after law enforcement actions against individuals allegedly linked to the group. Reports also suggest possible collaboration with the ransomware group Scattered Spider, with a ReliaQuest report citing a threat actor claim that the two groups “are the same.” In August 2025, a new Telegram channel called “Scattered LAPSUS$ Hunters” surfaced, hinting at coordinated campaigns by the groups. UNC6040 activity further revealed overlaps with the Com group, believed to be a network of sub-groups including members of both Scattered Spider and ShinyHunters. These findings suggest a potential alliance or shared infrastructure among these threat actors.
Amid these speculations, the recent arrests of two Scattered Spider members in England and a post on the Scattered LAPSUS$ Hunters channel, claiming an attack on British carmaker Jaguar Land Rover and announcing, “Our objectives having been fulfilled, it is now time to say goodbye”, suggest the groups may pause their activities. However, this should not be seen as the end of their operations, as they could resurface under new identities or regroup under different names.
To reduce the risk of Salesforce data theft campaigns, organizations should educate employees on phishing and vishing tactics used for initial access. Multiple layers of authentication should be required for phone-based issue resolution to verify both IT personnel and employee identities. Given the increasing abuse of the Data Loader application, organizations are also advised to follow Salesforce security best practices, such as restricting access by IP address and leveraging Salesforce Shield for enhanced protection.
SonicWall Breach Disclosure
Bottom Line: SonicWall disclosed a security breach impacting cloud backups service for its firewall. The stolen data included encrypted credentials and information that could be used to facilitate exploitation of firewall appliances.
On September 18th, 2025, SonicWall disclosed a security incident involving unauthorized access to its MySonicWall cloud backup service. This service stores firewall preference files for SonicWall devices. The incident was the result of brute-force attempts targeting the backup system, potentially exposing configuration files of affected devices. SonicWall has confirmed that the event was not a ransomware attack and that less than 5% of its firewall install base was impacted.
The incident involved unauthorized access to firewall configuration backup files stored in the MySonicWall cloud platform. These preference files may contain encrypted credentials, network configurations, and service-related details. While SonicWall has stated that, as of now, there is no evidence that the stolen files have been publicly leaked, attackers could leverage this information to attempt device exploitation.
The incident affected a small subset of customers who had firewall backup files stored in the MySonicWall cloud environment. Devices without cloud-stored backups are not impacted. Affected customers can verify exposure by reviewing the issue list in the Product Management tab of the MySonicWall portal.
eSentire Threat Intelligence Analysis:
The MySonicWall Cloud Backup File Incident underscores the risks associated with storing sensitive firewall configuration files in cloud-based services. Although SonicWall has confirmed that the overall impact is limited, organizations utilizing the affected backup service should treat this incident as a high-priority security concern.
Recently, SonicWall devices have been targeted by ransomware groups, including Sinobi and Akira. Rapid7 published a report highlighting attacks on SonicWall appliances, which have led to the deployment of Akira ransomware. On September 10th, 2025, the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) issued an advisory warning organizations about the ongoing exploitation of CVE-2024-40766. eSentire initially published an advisory for CVE-2024-40766 in September 2024, and for the attacks observed in August 2025.
In August 2025, eSentire's Threat Response Unit (TRU) identified a ransomware attack linked to an affiliate of the Sinobi Group. This member used compromised credentials from a third-party Managed Service Provider (MSP) for SonicWall SSL VPN, which mapped to an over-privileged Active Directory account. This allowed for internal network access and direct RDP access to a file server. At the time of writing, there is no credible connection between the SonicWall breach and recent ransomware activity.
SonicWall has published an “Essential Credential Reset” and “Remediation Playbook” document that provides organizations with containment, remediation, and monitoring steps in response to the MySonicWall cloud backup incident. This document is intended to ensure that potentially exposed credentials and configurations are fully secured and that organizations reduce the risk of further compromise.
This guidance is critical because even though the credentials contained in backup files were encrypted, attackers could still attempt to crack or misuse them. Resetting all credentials eliminates this possibility. Restricting remote access during the reset process ensures that attackers cannot exploit old credentials while changes are being made. Continuous monitoring provides assurance that any attempts to use compromised information can be detected quickly, allowing organizations to respond before significant damage occurs.
In response to the release of this advisory, the eSentire Threat Intelligence team is actively tracking this topic for new details and detection opportunities. Organizations can learn more about defending SonicWall and other edge devices through the September 2025 TRU Intelligence Briefing.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
