GitHub Account Breach Triggers Supply Chain Attack: 22 Companies Affected via Salesloft Drift

Stored notes, separate from the original source; may contain errors. Verify claims and remediation against the original publisher.

## **TL;DR**
A **GitHub account compromise** at Salesloft led to a **supply chain breach** affecting **22 companies** via its Drift application. The threat actor, identified as **UNC6395**, accessed Salesloft's GitHub account between **March and June 2025**, highlighting the risks of third-party vulnerabilities in cybersecurity. This incident underscores the importance of securing development platforms and monitoring for unauthorized access.

---

## **Introduction**
In an era where **supply chain attacks** are becoming increasingly sophisticated, a recent breach at **Salesloft** has raised alarms across the cybersecurity community. The incident, which originated from a **compromised GitHub account**, allowed threat actors to infiltrate Salesloft's **Drift application**, impacting **22 companies**. Investigations led by **Google-owned Mandiant** revealed the involvement of a threat actor tracked as **UNC6395**, who maintained unauthorized access for **three months**.

This article delves into the **timeline of the breach**, the **tactics employed by the threat actor**, and the **broader implications** for organizations relying on third-party platforms.

---

## **The Breach: How It Happened**

### **1. Initial Compromise: GitHub Account Takeover**
The breach began with the **compromise of Salesloft's GitHub account**, a critical repository for the company's software development and collaboration. According to Mandiant's investigation:

- The threat actor, **UNC6395**, gained access to the GitHub account in **March 2025**.
- The unauthorized access persisted **undetected until June 2025**, allowing the actor to explore and potentially manipulate code repositories.
- GitHub accounts are prime targets for attackers due to their role in **software development, deployment, and version control**.

### **2. Exploitation of the Drift Application**
Once inside Salesloft's GitHub account, the threat actor focused on the **Drift application**, a tool widely used for **customer engagement and sales automation**. The compromise of Drift enabled a **supply chain attack**, where malicious code or access could propagate to Salesloft's clients.

Key details include:
- **22 companies** confirmed they were affected by the breach, though the full extent of the damage remains under investigation.
- The attack highlights the **risks of third-party dependencies** in modern software ecosystems.
- Supply chain attacks are particularly insidious because they exploit **trusted relationships** between vendors and clients.

---

## **Threat Actor Profile: UNC6395**
Mandiant identified the threat actor as **UNC6395**, a group known for its **sophisticated tactics** and **targeted attacks**. While details about UNC6395 remain limited, their operations suggest a focus on **high-value targets** and **prolonged infiltration**.

### **Tactics, Techniques, and Procedures (TTPs)**
- **Persistence**: The actor maintained access for **three months**, indicating a deliberate effort to remain undetected.
- **Lateral Movement**: By compromising GitHub, the actor could potentially move across connected systems and applications.
- **Supply Chain Exploitation**: UNC6395 leveraged Salesloft's Drift application to **amplify the impact** of the breach across multiple organizations.

---

## **Why This Breach Matters**
The Salesloft-Drift breach serves as a stark reminder of the **vulnerabilities inherent in supply chains** and the **critical importance of securing development platforms**. Key takeaways include:

### **1. The Risks of Third-Party Dependencies**
Organizations increasingly rely on **third-party tools and platforms** like GitHub for development and collaboration. However, these dependencies introduce **additional attack surfaces** that threat actors can exploit.

### **2. The Importance of Continuous Monitoring**
The breach went undetected for **three months**, emphasizing the need for **real-time monitoring** and **anomaly detection** in critical systems. Regular audits and access reviews can help identify unauthorized activity early.

### **3. Supply Chain Attacks Are on the Rise**
Supply chain attacks have surged in recent years, with high-profile incidents like the **SolarWinds breach** demonstrating their destructive potential. Organizations must prioritize **vendor risk management** and **secure coding practices** to mitigate these threats.

---

## **Lessons for Organizations**
To defend against similar breaches, organizations should consider the following measures:

### **1. Secure Development Platforms**
- Implement **multi-factor authentication (MFA)** for all development and collaboration tools.
- Regularly audit **access logs** and **user permissions** to detect anomalies.

### **2. Monitor Third-Party Risks**
- Conduct **vendor risk assessments** to evaluate the security posture of third-party tools.
- Use **automated tools** to scan for vulnerabilities in dependencies.

### **3. Incident Response Preparedness**
- Develop and test an **incident response plan** to ensure rapid containment and recovery.
- Collaborate with **cybersecurity firms** like Mandiant for **threat intelligence** and forensic analysis.

---

## **Conclusion**
The **Salesloft GitHub breach** is a wake-up call for organizations worldwide. By compromising a single GitHub account, threat actors were able to orchestrate a **supply chain attack** affecting **22 companies**, underscoring the far-reaching consequences of third-party vulnerabilities.

As cyber threats evolve, businesses must adopt a **proactive and layered approach** to security, focusing on **continuous monitoring, vendor risk management, and incident response readiness**. The lessons from this breach can help organizations **strengthen their defenses** and mitigate the risks of future attacks.

---

## **Additional Resources**
For further insights, check:
- [Mandiant's Report on UNC6395 and Supply Chain Attacks](https://thehackernews.com/2025/09/github-account-compromise-led-to.html)
- [GitHub Security Best Practices](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure)
- [Understanding Supply Chain Attacks](https://www.cisa.gov/supply-chain-security)