Threat Actor
Icarus
Properties
- summary
- A new extortion group calling itself Icarus publicly claimed responsibility for the Klue OAuth breach, stealing OAuth tokens used to access customers' Salesforce environments.
- first_seen
- 2026-06-23T15:34:11.293599+00:00
- last_seen
- 2026-06-23T15:34:11.293599+00:00
- created_at
- 2026-06-23T15:34:11.293599+00:00
- mention_count
- 1
- evidence_url
- https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/
- resolution_basis
- exact name match to existing RansomwareGroup/RansomGroup 'Icarus'
- target
- Technology / SaaS platforms
- resolution_method
- automatic
- provenance
- news-scan
- rule_version
- 2026-09-12.1
- resolution_rule
- R2_name_matches_known_actor
- resolved_at
- 2026-09-12T04:34:24+00:00
- scan_confidence
- 0.75
- suspected_origin
- unknown
Explore this actor's full graph with Ninja Signal