Google Publishes Security Hardening Guide to Counter UNC6040 Threats

According to Google’s Threat Intelligence Group (GTIG), the security hardening guidance targets UNC6040 threats, which have relied on social engineering and malicious use of legitimate SaaS features rather than Salesforce code flaws. The guide focuses on protecting Salesforce and other central identity providers through a three‑pronged framework: proactive hardening measures, comprehensive logging protocols, and targeted detection capabilities to curb credential compromise and data exfiltration.

It recommends a layered approach covering identity verification, phishing‑resistant MFA such as FIDO2 keys, SSO, and device posture checks, alongside SaaS application hardening like restricting login IP ranges and adopting a deny‑by‑default stance for connected apps.

Logging and detection guidance emphasises ingesting Salesforce Shield and Event Monitoring logs into SIEM with real‑time streaming, to spot patterns such as OAuth‑driven data exfiltration within minutes and lateral movement via Okta or Microsoft 365 logins from the same risky egress IP.

While Salesforce is the primary focus, many recommendations apply across SaaS ecosystems, including centralised identity providers and other cloud services, and aim to elevate identity, application controls, and continuous monitoring to stay ahead of vishing and data‑theft techniques. 1 October 2025