Salesforce Data Exfiltration
Campaign · ATTACK:enterprise:C0059
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0059",
"title": "Salesforce Data Exfiltration",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0059",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--9cea8bec-07c5-422b-84b8-99d3128ce570",
"external_id": "C0059",
"domain": "enterprise",
"created": "2025-10-22T14:02:44.965Z",
"modified": "2026-10-09T21:13:16.085Z",
"version": "1.0",
"aliases": [
"Salesforce Data Exfiltration"
],
"tactics": [
],
"source_references": [
{
"source_name": "FBI Salesforce Data Theft SEP 2025",
"url": "https://www.ic3.gov/CSA/2025/250912.pdf"
},
{
"source_name": "Google Salesforce JUN 2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--020466ec-f701-4d9b-9fb7-4bcbc849069b
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1608.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--110fd4fd-3b1c-47d4-9e23-fb6b5346fc5e
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11be19d8-c5f8-4f11-a26a-9e60e5d4b763
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1213.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa76367-d460-459d-90f7-a1b3a0677792
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1671
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bebb783-8a63-4fab-ae3e-707a352e687d
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e3b8b61-70f2-4824-9b9c-cc532aa17c7e
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1567
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ab1151f-ff1b-4d3a-89c8-db6ba77ba823
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d7fd920-ea04-483b-98bf-dbf7bfac67f4
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d4cf656-ce12-4a52-93ad-0a0545c8a144
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f7853bd-a4d6-418f-8d23-d24fc32dffa0
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70b014d2-627e-41cc-98ae-794032eb5117
FBI Salesforce Data Theft SEP 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74ca2dd6-3194-42f3-bee6-6a9a59b082ab
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1585
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75925ae3-c470-4a6b-aac5-839b470c8436
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89009e94-5631-46f4-9760-460712d89491
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93cd8b4b-1d7a-4eeb-8ade-b5b9aaf936ec
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad3b3ea9-04f8-42f7-b88a-0d33fdb3854e
FBI Salesforce Data Theft SEP 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd3b70d0-9cd4-48e1-afd3-3457d7b5f8df
Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db256e63-e369-4fc4-985a-ce830f4292b9
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:S0183
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0a3c854-979e-4851-b665-4f3981d483fe
Google Salesforce JUN 2025