MalwarePublished 26 Nov 2025Updated 27 Nov 2025

Salesforce Gainsight Security Advisory · Nov 2025

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Salesforce Gainsight Security Advisory - Nov 2025

Impact

For European organizations, this threat could lead to significant operational disruption through ransomware attacks that encrypt critical business data and cloud resources. The compromise of application access tokens and cloud accounts could result in unauthorized data access, data exfiltration, and loss of confidentiality. Integrity of business processes relying on Salesforce Gainsight could be affected, impacting customer relationship management and analytics functions. Availability of services may be disrupted due to ransomware encryption and potential downtime during incident response and recovery. Organizations with extensive cloud deployments and SaaS integrations are particularly vulnerable, as attackers exploit token-based authentication and valid accounts to bypass traditional perimeter defenses. The medium severity indicates a moderate but credible risk that could escalate if attackers develop exploits or increase campaign activity. European businesses in finance, technology, and services sectors using Salesforce Gainsight are at heightened risk, potentially facing financial losses, reputational damage, and regulatory scrutiny under GDPR if personal data is compromised.

Defensive guidance

1. Implement strict monitoring and auditing of application access tokens, including regular rotation and immediate revocation of unused or suspicious tokens. 2. Enforce multi-factor authentication (MFA) for all cloud accounts and Salesforce Gainsight access to reduce the risk of credential compromise. 3. Conduct proactive threat hunting focused on detecting active scanning activities and anomalous token usage patterns within cloud environments. 4. Harden cloud account security by applying the principle of least privilege, ensuring accounts have only necessary permissions. 5. Utilize cloud security posture management (CSPM) tools to identify misconfigurations and potential exposure points in Salesforce Gainsight and associated cloud services. 6. Establish incident response playbooks specifically addressing ransomware scenarios involving cloud SaaS platforms. 7. Educate staff on phishing and social engineering risks that could lead to token or credential theft. 8. Collaborate with Salesforce Gainsight support and security teams to stay informed about emerging threats and potential patches or mitigations. 9. Regularly back up critical data with offline or immutable storage to enable recovery without paying ransom. 10. Integrate threat intelligence feeds to stay updated on Scattered Lapsus$ Hunters’ tactics and indicators of compromise.

Indicators of compromise

IP addresses 16

104.3.11.1
198.54.135.148
198.54.135.197
198.54.135.205
146.70.171.216
169.150.203.245
172.113.237.48
45.149.173.227
135.134.96.76
65.195.111.21

Text 16

AT&T IP; reconnaissance and unauthorized access.
Mullvad VPN proxy IP; reconnaissance and unauthorized access.
Mullvad VPN proxy IP; reconnaissance and unauthorized access.
Mullvad VPN proxy IP; reconnaissance and unauthorized access.
Mullvad VPN proxy IP; reconnaissance and unauthorized access.
Surfshark VPN proxy IP; reconnaissance and unauthorized access.
NSocks VPN proxy IP; reconnaissance and unauthorized access.
Surfshark VPN proxy IP; reconnaissance and unauthorized access.
IProxyShop VPN proxy IP; reconnaissance and unauthorized access.
IProxyShop VPN proxy IP; reconnaissance and unauthorized access.

Datetime 16

2025-11-08T00:00:00+00:00
2025-11-16T00:00:00+00:00
2025-11-16T00:00:00+00:00
2025-11-18T00:00:00+00:00
2025-11-18T00:00:00+00:00
2025-11-18T00:00:00+00:00
2025-11-18T00:00:00+00:00
2025-11-18T00:00:00+00:00
2025-11-19T00:00:00+00:00
2025-11-19T00:00:00+00:00

Community reviews

Loading reviews…