Data Is the New Diamond: Latest Moves by Hackers and Defenders

This report summarizes recent developments in data theft campaigns targeting Salesforce instances—notably the Salesloft Drift supply-chain compromise attributed to UNC6395—and related activity by criminal clusters (Muddled Libra/Scattered Spider, Bling Libra). It highlights actors' Telegram activity, emphasis on social engineering and credential/data exfiltration from Salesforce objects, potential shifts in monetization to data theft extortion, recent enforcement actions, and recommended defensive measures such as participation in RH-ISAC and Salesforce-specific mitigations.