Loading threat actor…
Storm-3138 is a Microsoft-tracked threat actor associated with the June 2026 compromise of Klue and subsequent unauthorized access to downstream customer SaaS environments, particularly Salesforce. The actor operated by abusing trusted application relationships rather than exploiting an inherent Salesforce software vulnerability. In the Klue incident, access to Klue enabled theft or misuse of credentials and OAuth-linked access that was then used to discover, query, and exfiltrate customer data from connected Salesforce instances. Reporting also links the same activity to access against Gong data for some affected customers. Storm-3138 fits a broader pattern of Salesforce-focused intrusions observed from mid-2025 to mid-2026 in which attackers leveraged legitimate OAuth trust relationships, inherited application privileges, and authorized integrations to blend into normal SaaS workflows. Across these campaigns, attackers conducted discovery, bulk querying of CRM repositories, persistent API-based access, and exfiltration of sensitive business records such as account, contact, and service-related data. The tradecraft overlaps with activity widely associated with the ShinyHunters data-extortion ecosystem, and the Klue-related extortion activity has also been associated with the name Icarus. The actor’s known behavior centers on post-compromise abuse of third-party SaaS integrations and cloud application tokens. This includes using compromised vendor-side access to reach downstream customer tenants, operating through legitimate APIs, and taking advantage of the visibility gaps that arise when malicious actions are performed through approved applications and trusted identities. High-confidence reporting supports capabilities including initial access via compromised integration credentials, persistence through retained OAuth or application access, reconnaissance and discovery within SaaS environments, and exfiltration of CRM and related cloud-hosted data. The activity is consistent with financially motivated data theft and extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Actor tied to the June 2026 Klue compromise, where a legacy credential was abused to push code that harvested customer OAuth tokens and enabled access to Salesforce and Gong data for extortion or theft.
Threat actor tied to the Klue incident that used credentials to access Salesforce customer instances for discovery, querying, and data exfiltration in a manner similar to the broader activity discussed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.