FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data

The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organisations’ Salesforce environments to steal data and extort victims, according to FBI. The advisory notes that both groups have recently been observed targeting Salesforce platforms via different initial access mechanisms, with data theft and extortion activity occurring since at least June and August this year.

UNC6040 first surfaced when Google Threat Intelligence (Mandiant) described social engineering and vishing attacks leading to Salesforce Data Loader OAuth apps being connected to victims’ accounts, enabling mass exfiltration that ShinyHunters later used for extortion.

In August, attackers again targeted Salesforce customers by using stolen Salesloft Drift OAuth and refresh tokens to breach instances, with exfiltrated data including secrets, credentials, and authentication tokens such as AWS keys, passwords and Snowflake tokens, the FBI said.

The article notes that while the FBI did not name the groups behind these campaigns, BleepingComputer was told by the ShinyHunters extortion group that they and others calling themselves “Scattered Lapsus$ Hunters” were responsible, with claims that they later announced plans to “go dark” and even gained access to certain law-enforcement systems, according to the report.