Daily Briefing for 08.28.25

At a glance.

• FBI says Salt Typhoon targeted more than 80 countries.
• Attackers breach hundreds of Salesforce instances via third-party app.
• Ransomware group shifts focus to the cloud.
• US Treasury sanctions fraud network associated with North Korea's IT worker operations.

FBI says Salt Typhoon targeted more than 80 countries.

The Wall Street Journal reports that the Chinese cyberespionage campaign known as "Salt Typhoon" targeted approximately 600 organizations across more than 80 countries. Brett Leatherman, the FBI's Deputy Assistant Director for Cyber Operations, told the Journal that the campaign was "broader and more indiscriminate than previously understood, and beyond what countries usually understand to be espionage." The FBI believes the hackers obtained more than a million call records and specifically targeted the phone calls and text messages of around 100 Americans.

The threat actors also compromised telecommunication providers in other countries, with varying degrees of access. Leatherman added, "If you are able to exfiltrate similar information globally you can start to aggregate that data and start to understand a much different intelligence picture than what you would get if you just targeted and compromised one country."

Attackers breach hundreds of Salesforce instances via third-party app.

Google's Threat Intelligence Group (GTIG) warns that attackers compromised hundreds of Salesforce instances using stolen OAuth tokens from a third-party AI chatbot called "Salesloft Drift." Tyler McLellan, principal threat analyst at GTIG, explained, "Using a single token stolen from Salesloft, the threat actor was able to access tokens for any Drift-linked organization. The threat actor then used the Salesforce tokens to directly access that data and exfiltrate it to servers, where they looked for plaintext credentials, including Amazon, Snowflake, and other passwords." GTIG added, "The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials."

The campaign began on August 8th and lasted through at least August 18th. On August 20th, Salesloft revoked all the attackers' access by refreshing tokens from the Drift application. Salesforce has removed Drift from the Salesforce AppExchange until further notice.

Ransomware group shifts focus to the cloud.

Microsoft says the financially motivated threat actor Storm-0501 has shifted from deploying ransomware on endpoints to launching cloud-based ransomware attacks. Microsoft explains, "Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, cloud-based ransomware introduces a fundamental shift. Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom—all without relying on traditional malware deployment."

US Treasury sanctions fraud network associated with North Korea's IT worker operations.

The US Treasury Department has sanctioned a fraud network that supported North Korea's IT worker schemes, TechCrunch reports. Treasury's Office of Foreign Assets Control (OFAC) named a Russian national, a North Korean official based in Russia, a Chinese front company, and a DPRK state-owned company as participants in the scheme. Treasury stated, "Today’s action expands on the designation of Chinyong Information Technology Cooperation Company, targeting additional entities in its network and combating its use of cryptocurrency for sanctions evasion."