Loading threat actor…
Google Threat Intelligence Group (GTIG) is Google’s cyber threat intelligence organization. It tracks and analyzes malicious cyber activity, including identity-centric intrusions that abuse trusted cloud integrations and OAuth-based access. In the documented 2025 Drift-related intrusion activity, GTIG tracked a threat actor that used stolen OAuth tokens associated with the Salesloft Drift application to access Salesforce environments and a small number of Google Workspace mailboxes connected through Drift Email. The actor relied on valid bearer and refresh tokens rather than malware, enabling reconnaissance, bulk data access, exfiltration, and subsequent deletion of evidence through normal-looking API activity. Observed behavior included tenant and object enumeration, large-scale data collection via platform APIs, access to mailbox data through abused OAuth integrations, and defense evasion through removal of artifacts associated with bulk export jobs. GTIG’s reporting emphasized the security risks posed by agentic or non-human identities that are broadly trusted but insufficiently inventoried, monitored, and governed across SaaS platforms.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.