Why the UNC6395 Breach Is Likely to Cascade—Just Like Snowflake’s Did

The Salesforce–Drift breach may appear scoped to a single third-party integration, but the tactics used by UNC6395 mirror the early stages of the Snowflake breach in 2024.

In both cases, attackers didn’t just steal data—they harvested credentials and secrets that could be reused across environments. That’s the real risk: credential portability.

What UNC6395 Did

According to Google Cloud’s Threat Intelligence Group, UNC6395 used compromised OAuth tokens from the Drift app to access Salesforce customer instances and exfiltrate objects like Accounts, Users, Opportunities, and Cases. They then searched for embedded secrets—AWS access keys, Snowflake tokens, passwords—that could be used to compromise other platforms.

This is the same playbook UNC5537 used in the Snowflake breach.

What Happened with Snowflake

In 2024, UNC5537 (aka “Judische” or “Waifu”) accessed Snowflake customer environments using credentials stolen via infostealer malware. The breach eventually impacted over 165 organizations, including:

• AT&T: Call and text records for 109 million customers were exposed

• Ticketmaster: 590 million records offered for sale on the dark web

• Santander Bank: Customer databases compromised

• Advance Auto Parts: 2.3 million customer records leaked

• LendingTree: Financial data targeted

The breach began with a single contractor endpoint and escalated into one of the largest credential-based compromises in recent memory3.

Why This Pattern Will Repeat

• Secrets are portable: An AWS key found in Salesforce can be used to access unrelated infrastructure.

• OAuth tokens are under-monitored: Most orgs don’t log or rotate them with the same rigor as passwords or API keys.

• Third-party apps are over-permissioned: Drift had access to sensitive Salesforce objects—many other apps likely do too.

• Attackers are patient: UNC6395 deleted query jobs to avoid detection, suggesting long-term intent.

In short, the Salesforce breach is not the end—it’s the beginning of a credential cascade. Just as Snowflake’s breach started with a single contractor and ended with global data exposure, the Drift incident may be the first domino in a broader SaaS compromise.