ExtortionModerate confidence

Icarus

Icarus is retained as an emerging extortion/data-theft actor label for the Klue-linked Salesforce OAuth abuse activity. IntelliOS treats Icarus as useful operational vocabulary, while preserving source boundaries around UNC6395, Salesloft Drift, SLH, and other Salesforce-focused labels until public sources explicitly merge them.

Directory Briefing

Top 10 Talking Points

Icarus is tracked as a ransomware and extortion operation.¹

Treat the named ransomware as the visible impact component of a broader intrusion, not as proof of who performed every earlier action.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems.¹

Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Security and recovery controls are part of the target set.¹

Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

Retained targeting includes Retail, Information Services, Finance, Professional&Technical Services, and Educational Services across Canada, Switzerland, Germany, and France; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Bottom Line Up Front

BLUF

Icarus is tracked as a ransomware and extortion operation.¹

Treat the named ransomware as the visible impact component of a broader intrusion, not as proof of who performed every earlier action.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems.¹

Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Security and recovery controls are part of the target set.¹

Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

Emerging data-theft and extortion actor label tied to Klue/Salesforce OAuth-token abuse

First Seen¹

Late April to early May 2026 public DLS footprint in ZeroFox reporting

Last Seen¹

Jul 2026

Origin¹

Unknown

Motivation¹

Financial

Primary Access Pattern¹

Abuse of trusted third-party integration credentials and OAuth tokens rather than a direct Salesforce platform exploit.

Objective¹

Bulk CRM data theft, direct extortion, leak-site pressure, and monetization of business-contact, sales, support, and relationship context.

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Icarus hackersIcarus extortion groupmr bean

Source Boundary

Icarus is source-backed for the Klue-linked extortion/data-theft activity. UNC6395 is source-backed for the earlier Salesloft Drift Salesforce OAuth campaign; IntelliOS treats that as adjacent comparator context, not a proven Icarus alias.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

United StatesGlobal SaaS customersSalesforce-connected organizations

Target Sectors^1,2

SaaSCybersecurityCRM / sales operationsEnterprise software

Associated Activity¹

Trusted SaaS integration abuseOAuth token theftSalesforce API data collectionLeak-site and direct-email extortion

ATT&CK IDs¹

T1199 - Trusted RelationshipT1528 - Steal Application Access TokenT1078 - Valid AccountsT1119 - Automated CollectionT1567 - Exfiltration Over Web Service

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
Klue Salesforce OAuth Supply-Chain Attack^3,5,8	Klue Salesforce OAuth Supply-Chain Attack is retained in the campaign database for Icarus. A compromised legacy credential in Klue integration infrastructure enabled OAuth-token access to connected Salesforce environments. The campaign is retained as a third-party SaaS supply-chain and CRM data-exposure scenario, with Icarus included as a source-bound analytical lead that requires deconfliction from other public actor reporting.

Campaign / Operation

Source-Backed Context

Klue Salesforce OAuth Supply-Chain Attack^3,5,8

Klue Salesforce OAuth Supply-Chain Attack is retained in the campaign database for Icarus. A compromised legacy credential in Klue integration infrastructure enabled OAuth-token access to connected Salesforce environments. The campaign is retained as a third-party SaaS supply-chain and CRM data-exposure scenario, with Icarus included as a source-bound analytical lead that requires deconfliction from other public actor reporting.

Indicators

IOCs And Observable Retention

SOCRadar reported 156²IntelliOS retained 34^{3,4,5,6,7,8,9,10}

SOCRadar reports 156 IOCs for this profile. IntelliOS currently retains 32 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 12 source groups tracked; 11 currently contribute retained observable or context rows.

Retained Observables

Showing 34 of 34

Type	Value	Source
File Path	/services/data/v59.0/query⁷	Datadog
File Path	/services/data/v59.0/query/{locator}⁷	Datadog
File Path	/services/data/v59.0/query/*⁷	Datadog
File Path	/services/data/v59.0/sobjects⁷	Datadog
User Agent	5238⁷	Datadog
User Agent	python-urllib/3.12⁸	Obsidian
User Agent	Python-urllib/3.12⁷	Datadog
User Agent	python-urllib/3.14⁸	Obsidian
User Agent	Python-urllib/3.14⁷	Datadog
Tool / Process	GitHub personal access token (PAT)⁴	CrowdStrike
Tool / Process	Google Kubernetes Engine integration-service pod⁴	CrowdStrike
Tool / Process	Klue Battlecards connected app⁶	ReliaQuest
Tool / Process	QueryMore pagination⁶	ReliaQuest
Tool / Process	Salesforce OAuth access token⁶	ReliaQuest
Tool / Process	Salesforce OAuth refresh token⁶	ReliaQuest
Tool / Process	Salesforce REST API⁶	ReliaQuest
Tool / Process	Session Messenger extortion contact⁶	ReliaQuest
Technique	T1199 Trusted Relationship	Retained source
Technique	T1528 Steal Application Access Token	Retained source
Technique	T1567 Exfiltration Over Web Service	Retained source
Network Indicator	138.226.246.94⁹	FINRA
Network Indicator	159.183.181.239⁹	FINRA
Network Indicator	159.183.215.61⁹	FINRA
Network Indicator	212.86.125.24⁹	FINRA
Network Indicator	213.111.148.90⁹	FINRA
Network Indicator	94.154.32.160⁹	FINRA
Campaign Context	Datadog reported Python-urllib/3.12, Python-urllib/3.14, and 5238 user-agent leads against Salesforce v59.0 query endpoints.⁷	Datadog
Campaign Context	FINRA retained suspicious IP leads, the 'mr bean' alias, extortion-monitoring guidance, and member-firm mitigations for Klue OAuth/Salesforce data exfiltration.⁹	FINRA
Campaign Context	Klue disclosed unauthorized activity affecting integration infrastructure, legacy credential access, OAuth token theft, and connected-platform data access.³	Klue
Campaign Context	Klue's CrowdStrike investigation summary attributed credential collection to unauthorized code introduced through a compromised GitHub PAT and said Klue disabled affected GKE pods/PATs and rotated OAuth credentials on June 12.⁴	CrowdStrike
Campaign Context	Obsidian reported user-agent and source-IP deviations, Global Describe reconnaissance, SOQL query activity, and QueryMore pagination as detection leads.⁸	Obsidian
Campaign Context	ReliaQuest reported automated Salesforce REST API enumeration and QueryMore pagination using OAuth tokens from the compromised Klue integration path.⁶	ReliaQuest
Campaign Context	Salesforce stated the issue was limited to Klue's app connection and was not caused by a Salesforce platform vulnerability.⁵	Salesforce General Message 20000257
Campaign Context	ZeroFox described Icarus as a financially motivated ransomware and data-extortion actor while caveating possible Scattered Lapsus$ Hunters association signals.¹⁰	ZeroFox Intelligence Profile

Source	Reported	Retained	Coverage Status
SOCRadar²	156	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
Klue³	N/A	1	Public observables or source-context rows retained and displayed.
Klue⁴	N/A	3	Public observables or source-context rows retained and displayed.
Salesforce Status⁵	N/A	1	Public observables or source-context rows retained and displayed.
ReliaQuest⁶	N/A	7	Public observables or source-context rows retained and displayed.
Datadog Security Labs⁷	N/A	8	Public observables or source-context rows retained and displayed.
Obsidian Security⁸	N/A	3	Public observables or source-context rows retained and displayed.
FINRA⁹	N/A	7	Public observables or source-context rows retained and displayed.
ZeroFox Intelligence¹⁰	N/A	1	Public observables or source-context rows retained and displayed.
MITRE ATT&CK	N/A	1	Public observables or source-context rows retained and displayed.
MITRE ATT&CK	N/A	1	Public observables or source-context rows retained and displayed.
MITRE ATT&CK	N/A	1	Public observables or source-context rows retained and displayed.

Actor Chronology

Observed Activity Timeline

Date	Event	Evidence Boundary
Apr 2026²	Earliest retained public activity window	The retained profile places the actor's public leak-site footprint in late April to early May 2026. This is source-labeled activity context, not an inferred publication date.
Jul 2026^2,3	Most recent retained activity window	Latest activity period retained by the curated Icarus profile and related Klue campaign coverage.
Jul 9, 2026	IntelliOS actor record updated	Record-maintenance date; it is not treated as an actor activity or exploitation date.

IntelliOS Intel Products

Linked Products

Threat Actor Profile

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Icarus	Baseline actor-card record and ransomware/extortion directory source.	Useful as a discovery and profile seed; IntelliOS layers direct public reporting and source deconfliction on top.
Public reporting / direct notices	Icarus / Icarus hackers / Icarus extortion group	Supports the Klue-linked extortion/data-theft narrative and downstream disclosure matrix.	Primary victim notices control exact impact. Leak-site or claim-only lists are not treated as confirmed victims.
MITRE ATT&CK	Behavior mappings	Used for T1199, T1528, T1078, T1119, and T1567 behavior classification.	MITRE technique mappings classify behavior; they do not prove actor identity.
Google/GTIG and FBI	UNC6395 / Salesloft Drift	Retained as adjacent Salesforce OAuth-token theft comparator context.	Not merged into Icarus unless a reliable source explicitly merges the labels.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Icarus.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Threat actor directory source for profile fields and reported activity.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/icarus	Actor-specific source for ransomware profile metadata and reported IOC counts when available.
3	Klue: Recent Security Incident https://klue.com/blog/an-update-on-recent-klue-security-incident	Primary Vendor Disclosure
4	Klue: CrowdStrike Investigation Summary and Security Improvements https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements	Primary Vendor Disclosure
5	Salesforce General Message 20000257 https://status.salesforce.com/generalmessages/20000257	Vendor Statement
6	ReliaQuest: Klue Integration Abused in Salesforce Data Theft https://reliaquest.com/blog/threat-spotlight-integration-abused-in-crm-data-theft/	Vendor Research
7	Datadog: Detecting the Klue Supply Chain Attack in Salesforce https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/	Detection Guidance
8	Obsidian: Technical Analysis of the Klue Attack https://www.obsidiansecurity.com/blog/icarus-klue-salesforce-integration-supply-chain-attack	Detection Guidance
9	FINRA: Klue OAuth Breach and Salesforce Data Exfiltration https://www.finra.org/rules-guidance/guidance/cybersecurity-alert-klue-oauth-breach-and-salesforce-data-exfiltration	Regulator Guidance
10	ZeroFox Intelligence Profile: ICARUS https://www.zerofox.com/intelligence/zerofox-intelligence-profile-icarus/	Threat Profile

Loading Threat Actor Cards

Icarus

Top 10 Talking Points

Icarus is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

BLUF

Icarus is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

Icarus Threat Actor Profile

Klue Supply Chain Attack

Salesloft Drift OAuth Comparator Brief

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Loading Threat Actor Cards

Icarus

Top 10 Talking Points

Icarus is tracked as a ransomware and extortion operation.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems.1

Behavioral telemetry is more durable than a malware hash.1

Security and recovery controls are part of the target set.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

BLUF

Icarus is tracked as a ransomware and extortion operation.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems.1

Behavioral telemetry is more durable than a malware hash.1

Security and recovery controls are part of the target set.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

Icarus Threat Actor Profile

Klue Supply Chain Attack

Salesloft Drift OAuth Comparator Brief

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Icarus is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Icarus is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2