Critical Update: Astrix Research Team Discovers UNC6395 OAuth Compromise Spanning Salesforce, Google Workspace, and AWS
Following Google Threat Intelligence Group’s (GTIG) initial disclosure of the UNC6395 campaign targeting Salesforce environments through compromised Salesloft Drift OAuth tokens, Astrix Security has uncovered significant expansion of the threat actor’s activities across multiple cloud platforms. Our investigation reveals previously undisclosed attack vectors and provides critical indicators of compromise (IoCs) for security teams.
Background: The Initial Discovery
Between August 8 and 18, 2025, threat actor UNC6395 leveraged compromised OAuth tokens from the Salesloft Drift application to infiltrate Salesforce organizations. The campaign involved bulk data exfiltration and credential harvesting, specifically targeting AWS and Snowflake secrets while successfully bypassing multi-factor authentication (MFA) controls.
Salesforce and Salesloft responded on August 20, revoking all Drift tokens. Later, GTIG published a detailed report identifying the threat actor and its IoCs. Importantly, no core vulnerabilities were identified in the Salesforce platform itself.
In our initial advisory, Astrix recommended organizations take immediate action, including:
- Comprehensive review of Event Monitoring logs for anomalous queries and bulk exports
- Immediate revocation and rotation of potentially compromised tokens
- Full audit of connected applications with enforcement of least-privilege principles
- Thorough scanning of potentially exfiltrated datasets for exposed secrets
New Findings: Expanded Attack Surface
Astrix Security’s research team has identified critical new dimensions to this campaign:
Key Discoveries
Google Workspace Compromise
The Drift Email OAuth application for Google Workspace was also actively exploited by UNC6395, specifically for email exfiltrationAWS Reconnaissance
Identification of a suspicious AWS account systematically probing for publicly accessible S3 bucketsExpanded Infrastructure
Discovery of 183 previously undisclosed IP-based indicators of compromise, all are Tor exit nodes
Immediate Remediation Steps
Google Workspace Protection
Organizations must immediately revoke Drift Email access from their Google Workspace environment:
- Navigate to https://admin.google.com/u/1/ac/owl/list?tab=configuredApps logged in as Workspace Administrator
- Select “Configure new app” and input the Drift Email application ID
- Select the Drift Email application and click Continue
- Configure restriction scope (entire domain or specific organizational units)
- Set access status to “Blocked”
- Confirm changes by clicking Continue and Finish
Log Analysis Requirements
Security teams should conduct comprehensive searches across:
AWS CloudTrail
Identify S3 access attempts where the user identity originates from the suspected AWS account ID (see IoC section). The account ID appears under the userIdentity→accountId objectAll Security Logs
Review any access from newly identified suspicious IP addresses during the campaign window (August 8-18, 2025). Since these addresses are Tor exit nodes shared by legitimate users, access from these IPs alone should not be considered malicious. Security teams should look for these addresses performing suspicious actions during the campaign window.
Technical Analysis: Threat Actor Methodology
Our investigation leveraged analysis of millions of non-human identity activity logs, cross-referencing against GTIG’s published IoCs with emphasis on non-Tor infrastructure for lower false positives.
Attack Pattern Analysis
The threat actor’s tactics, techniques, and procedures (TTPs) align precisely with GTIG’s documented behavior:
- Systematic secret scanning within exfiltrated data
- Lateral movement across cloud services using harvested credentials
- Reconnaissance of publicly accessible resources following name extraction
AWS-Specific Activity
UNC6395’s AWS operations focused on anonymous access to S3 buckets, with bucket names likely extracted from compromised Salesforce environments. Failed authentication attempts inadvertently exposed the threat actor’s AWS account ID.
Our analysis indicates this malicious AWS account initiated operations in early August 2025, coinciding with the broader campaign timeline. The account generated traffic from 180 previously undisclosed IP addresses, all identified as Tor exit nodes.
Google Workspace App Breach
Update (August 29, 2025): After collaborating with Google Threat Intelligence Group (GTIG), we confirm that Google revoked all “Drift Email” Google Workspace OAuth tokens. If this app was authorized in your Workspace, those specific tokens have been invalidated by Google and no additional customer action is required to revoke them. However, Astrix and GTIG still recommend rotating any credentials/tokens issued to or used by Salesloft Drift, verifying the app is blocked/removed from allowlists, and reviewing Token/Gmail audit logs for any pre-revocation activity.
Most critically, we identified active UNC6395 operations through the Drift Email OAuth application in Google Workspace environments. This represents Salesloft Drift’s official Gmail integration and confirms that the token compromise extended beyond Salesforce infrastructure. Unlike the Salesforce tokens, these Google Workspace OAuth tokens remain active and continue to pose an immediate security risk.
Conclusion
This expanded understanding of the UNC6395 campaign makes one thing clear: comprehensive OAuth token management across every cloud is non-negotiable. Revoke suspect grants now, monitor continuously for the indicators we provided, and close the lateral movement paths created by chained OAuth abuse and harvested secrets.
Since non-human identities like service principals and application tokens are the pivots, Astrix delivers the coverage that matters: continuous NHI discovery, posture management, and threat detection, with automated remediation that cuts off abuse quickly.
For additional threat intelligence and updates on this developing situation, contact Astrix Security for a quick security assessment.
Indicators of Compromise
| Value | Description |
| 1084253493764-ipb2ntp4jb4rmqc76jp7habdrhfdus3q.apps.googleusercontent.com | Google OAuth App ID |
| 337122806991 | AWS Account ID |
| 5.2.79.190 | Tor Exit Node |
| 5.34.182.203 | Tor Exit Node |
| 5.255.101.10 | Tor Exit Node |
| 5.255.118.151 | Tor Exit Node |
| 5.255.123.158 | Tor Exit Node |
| 23.129.64.147 | Tor Exit Node |
| 23.151.8.8 | Tor Exit Node |
| 37.114.50.18 | Tor Exit Node |
| 37.114.50.124 | Tor Exit Node |
| 38.135.24.30 | Tor Exit Node |
| 38.135.24.72 | Tor Exit Node |
| 45.66.35.22 | Tor Exit Node |
| 45.66.35.35 | Tor Exit Node |
| 45.80.158.23 | Tor Exit Node |
| 45.83.104.137 | Tor Exit Node |
| 45.84.107.33 | Tor Exit Node |
| 45.84.107.47 | Tor Exit Node |
| 45.84.107.54 | Tor Exit Node |
| 45.84.107.74 | Tor Exit Node |
| 45.84.107.128 | Tor Exit Node |
| 45.84.107.200 | Tor Exit Node |
| 45.95.169.110 | Tor Exit Node |
| 45.132.246.245 | Tor Exit Node |
| 45.134.225.36 | Tor Exit Node |
| 45.138.16.240 | Tor Exit Node |
| 45.141.215.28 | Tor Exit Node |
| 45.141.215.95 | Tor Exit Node |
| 46.234.47.105 | Tor Exit Node |
| 51.15.59.15 | Tor Exit Node |
| 51.38.225.46 | Tor Exit Node |
| 54.36.108.162 | Tor Exit Node |
| 62.133.45.2 | Tor Exit Node |
| 66.220.242.222 | Tor Exit Node |
| 71.19.144.106 | Tor Exit Node |
| 80.94.92.99 | Tor Exit Node |
| 80.253.251.56 | Tor Exit Node |
| 88.80.26.2 | Tor Exit Node |
| 88.80.26.3 | Tor Exit Node |
| 88.80.26.4 | Tor Exit Node |
| 89.58.41.156 | Tor Exit Node |
| 89.234.157.254 | Tor Exit Node |
| 91.219.236.91 | Tor Exit Node |
| 93.123.109.116 | Tor Exit Node |
| 94.16.115.121 | Tor Exit Node |
| 94.142.244.16 | Tor Exit Node |
| 104.244.72.115 | Tor Exit Node |
| 107.189.1.228 | Tor Exit Node |
| 107.189.13.180 | Tor Exit Node |
| 107.189.29.184 | Tor Exit Node |
| 107.189.30.49 | Tor Exit Node |
| 109.70.100.1 | Tor Exit Node |
| 109.70.100.4 | Tor Exit Node |
| 109.70.100.5 | Tor Exit Node |
| 109.70.100.6 | Tor Exit Node |
| 109.70.100.66 | Tor Exit Node |
| 109.70.100.68 | Tor Exit Node |
| 109.70.100.69 | Tor Exit Node |
| 109.70.100.70 | Tor Exit Node |
| 109.70.100.71 | Tor Exit Node |
| 109.71.252.88 | Tor Exit Node |
| 109.71.252.97 | Tor Exit Node |
| 109.71.252.182 | Tor Exit Node |
| 109.104.153.22 | Tor Exit Node |
| 124.198.131.223 | Tor Exit Node |
| 124.198.132.13 | Tor Exit Node |
| 124.198.132.52 | Tor Exit Node |
| 124.198.132.172 | Tor Exit Node |
| 146.103.43.17 | Tor Exit Node |
| 154.53.58.161 | Tor Exit Node |
| 171.25.193.35 | Tor Exit Node |
| 171.25.193.37 | Tor Exit Node |
| 171.25.193.39 | Tor Exit Node |
| 171.25.193.77 | Tor Exit Node |
| 171.25.193.79 | Tor Exit Node |
| 171.25.193.80 | Tor Exit Node |
| 176.65.149.84 | Tor Exit Node |
| 176.65.149.96 | Tor Exit Node |
| 176.65.149.100 | Tor Exit Node |
| 178.175.148.246 | Tor Exit Node |
| 178.218.144.99 | Tor Exit Node |
| 179.43.159.195 | Tor Exit Node |
| 179.43.159.197 | Tor Exit Node |
| 179.43.159.198 | Tor Exit Node |
| 185.40.4.92 | Tor Exit Node |
| 185.40.4.100 | Tor Exit Node |
| 185.56.83.83 | Tor Exit Node |
| 185.100.85.132 | Tor Exit Node |
| 185.129.61.3 | Tor Exit Node |
| 185.129.61.5 | Tor Exit Node |
| 185.129.61.7 | Tor Exit Node |
| 185.150.28.13 | Tor Exit Node |
| 185.220.100.240 | Tor Exit Node |
| 185.220.100.243 | Tor Exit Node |
| 185.220.100.246 | Tor Exit Node |
| 185.220.100.250 | Tor Exit Node |
| 185.220.100.251 | Tor Exit Node |
| 185.220.100.254 | Tor Exit Node |
| 185.220.100.255 | Tor Exit Node |
| 185.220.101.3 | Tor Exit Node |
| 185.220.101.4 | Tor Exit Node |
| 185.220.101.6 | Tor Exit Node |
| 185.220.101.8 | Tor Exit Node |
| 185.220.101.9 | Tor Exit Node |
| 185.220.101.12 | Tor Exit Node |
| 185.220.101.13 | Tor Exit Node |
| 185.220.101.18 | Tor Exit Node |
| 185.220.101.21 | Tor Exit Node |
| 185.220.101.25 | Tor Exit Node |
| 185.220.101.33 | Tor Exit Node |
| 185.220.101.37 | Tor Exit Node |
| 185.220.101.53 | Tor Exit Node |
| 185.220.101.54 | Tor Exit Node |
| 185.220.101.96 | Tor Exit Node |
| 185.220.101.98 | Tor Exit Node |
| 185.220.101.99 | Tor Exit Node |
| 185.220.101.100 | Tor Exit Node |
| 185.220.101.102 | Tor Exit Node |
| 185.220.101.108 | Tor Exit Node |
| 185.220.101.110 | Tor Exit Node |
| 185.220.101.130 | Tor Exit Node |
| 185.220.101.133 | Tor Exit Node |
| 185.220.101.135 | Tor Exit Node |
| 185.220.101.138 | Tor Exit Node |
| 185.220.101.142 | Tor Exit Node |
| 185.220.101.143 | Tor Exit Node |
| 185.220.101.145 | Tor Exit Node |
| 185.220.101.149 | Tor Exit Node |
| 185.220.101.150 | Tor Exit Node |
| 185.220.101.152 | Tor Exit Node |
| 185.220.101.156 | Tor Exit Node |
| 185.220.101.160 | Tor Exit Node |
| 185.220.101.166 | Tor Exit Node |
| 185.220.101.167 | Tor Exit Node |
| 185.220.101.172 | Tor Exit Node |
| 185.220.101.173 | Tor Exit Node |
| 185.220.101.174 | Tor Exit Node |
| 185.220.101.175 | Tor Exit Node |
| 185.220.101.176 | Tor Exit Node |
| 185.220.101.180 | Tor Exit Node |
| 185.220.101.183 | Tor Exit Node |
| 185.220.101.187 | Tor Exit Node |
| 185.241.208.54 | Tor Exit Node |
| 185.246.188.73 | Tor Exit Node |
| 185.246.188.74 | Tor Exit Node |
| 185.247.184.105 | Tor Exit Node |
| 192.42.116.18 | Tor Exit Node |
| 192.42.116.26 | Tor Exit Node |
| 192.42.116.174 | Tor Exit Node |
| 192.42.116.177 | Tor Exit Node |
| 192.42.116.178 | Tor Exit Node |
| 192.42.116.179 | Tor Exit Node |
| 192.42.116.180 | Tor Exit Node |
| 192.42.116.181 | Tor Exit Node |
| 192.42.116.182 | Tor Exit Node |
| 192.42.116.191 | Tor Exit Node |
| 192.42.116.192 | Tor Exit Node |
| 192.42.116.193 | Tor Exit Node |
| 192.42.116.194 | Tor Exit Node |
| 192.42.116.195 | Tor Exit Node |
| 192.42.116.196 | Tor Exit Node |
| 192.42.116.197 | Tor Exit Node |
| 192.42.116.199 | Tor Exit Node |
| 192.42.116.200 | Tor Exit Node |
| 192.42.116.202 | Tor Exit Node |
| 192.42.116.208 | Tor Exit Node |
| 192.42.116.209 | Tor Exit Node |
| 192.42.116.210 | Tor Exit Node |
| 192.42.116.211 | Tor Exit Node |
| 192.42.116.214 | Tor Exit Node |
| 192.42.116.215 | Tor Exit Node |
| 192.42.116.218 | Tor Exit Node |
| 192.42.116.219 | Tor Exit Node |
| 192.108.48.150 | Tor Exit Node |
| 192.159.99.168 | Tor Exit Node |
| 193.189.100.197 | Tor Exit Node |
| 193.189.100.201 | Tor Exit Node |
| 193.189.100.206 | Tor Exit Node |
| 194.15.36.117 | Tor Exit Node |
| 194.87.55.98 | Tor Exit Node |
| 195.47.238.86 | Tor Exit Node |
| 195.47.238.87 | Tor Exit Node |
| 195.47.238.90 | Tor Exit Node |
| 198.96.155.3 | Tor Exit Node |
