Threat Actor
Icarus
0
indicators on this record
Properties
- Summary
- A new extortion group calling itself Icarus publicly claimed responsibility for the Klue OAuth breach, stealing OAuth tokens used to access customers' Salesforce environments.
- First seen
- 2026-06-23T15:34:11.293599+00:00
- Last seen
- 2026-06-23T15:34:11.293599+00:00
- Created at
- 2026-06-23T15:34:11.293599+00:00
- Mention count
- 1
- Evidence url
- https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/
- Resolution basis
- exact name match to existing RansomwareGroup/RansomGroup 'Icarus'
- Target
- Technology / SaaS platforms
- Resolution method
- automatic
- Provenance
- news-scan
- Rule version
- 2026-09-12.1
- Resolution rule
- R2_name_matches_known_actor
- Resolved at
- 2026-09-12T04:34:24+00:00
- Scan confidence
- 0.75
- Suspected origin
- unknown
Explore this actor's full graph with Ninja Signal