Loading threat actor…
Icarus is a recently emerged cyber extortion group active since at least April 2026 and best known for a June 2026 supply-chain intrusion involving Klue, a Canadian market-intelligence and competitive-enablement SaaS provider. In that operation, Icarus gained access to Klue’s integration infrastructure through a long-unused but still-active legacy credential associated with a pilot or test integration, then deployed unauthorized code to harvest OAuth tokens used by Klue’s customer integrations. Using those valid tokens, the group accessed downstream customer SaaS environments—most notably Salesforce, and in some cases Gong—without needing victim passwords, MFA bypass, or exploitation of a Salesforce software vulnerability. The actor then queried customer CRM environments directly and exfiltrated business data at scale, including contact records, sales and marketing communications, pricing and quote information, contract and subscription details, renewal information, and other commercial records. The Klue incident demonstrates Icarus’s emphasis on identity- and trust-abuse rather than traditional endpoint-centric intrusion. Reported tradecraft includes initial access via exposed or dormant credentials, malicious code insertion into a trusted integration service, theft and abuse of OAuth access and refresh tokens, impersonation of a legitimate third-party application inside customer environments, API-driven collection from SaaS platforms, and follow-on extortion against both the primary victim and downstream customers. Public reporting also ties Icarus to direct victim outreach with short deadlines and threats to publish stolen data, indicating a leak-site-centered extortion model. Multiple reports characterize the group as conducting data-only extortion rather than relying primarily on widespread encryption operations. Known victims and affected organizations publicly associated with Icarus activity include Klue and numerous downstream organizations whose Salesforce-connected data was exposed, including Huntress, Recorded Future, Jamf, Tanium, HackerOne, LastPass, BeyondTrust, Snyk, OneTrust, Sprout Social, Gong, Insurity, and others. Additional victim claims attributed to Icarus include organizations in the United States and Canada across technology, business services, and financial services. Reporting also notes overlap or attribution ambiguity between Icarus and the broader ShinyHunters-linked data-extortion ecosystem in the Klue case, with some defenders associating the activity to a group calling itself Icarus while a Telegram account claiming to be ShinyHunters also took credit. High-confidence attribution supports Icarus as the extortion brand used in the Klue campaign, but any deeper organizational relationship to ShinyHunters remains unresolved in open reporting. Icarus appears financially motivated, with operations centered on theft of sensitive business data and coercive payment demands backed by threatened publication. The group’s most distinctive capability is abuse of trusted SaaS integrations and delegated access paths to reach many downstream victims through a single upstream compromise.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware/extortion group claiming responsibility for the Klue supply-chain-style compromise, using stolen OAuth tokens from Klue integrations to access customer Salesforce environments and extort both Klue and affected clients.
Relatively new ransomware/extortion group described as conducting a SaaS supply chain compromise of Klue, exfiltrating sensitive CRM data and contributing to ongoing extortion risk even after ransom payment.
Conducted a supply chain attack against Klue by compromising a legacy integration credential, deploying malicious code to harvest OAuth tokens, and using those tokens to access multiple customer Salesforce environments for large-scale data export.
Conducted a SaaS supply-chain breach against Klue by abusing an unused service account credential, harvesting OAuth tokens, and using inherited trust to query Salesforce APIs and exfiltrate customer CRM data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.