FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks

The FBI has issued a flash alert detailing IoCs linked to two cybercriminal groups, UNC6040 and UNC6395, which are conducting data theft and extortion campaigns. According to the FBI, both groups have recently targeted organisations’ Salesforce platforms via different initial access mechanisms.

UNC6395 is described as a threat group that has run a widespread Salesforce data theft campaign in August 2025, exploiting compromised OAuth tokens for the Salesloft Drift application, following a breach of Salesloft’s GitHub account from March to June 2025. In response, Salesloft has isolated the Drift infrastructure, taken the AI chatbot offline, and started implementing new multi-factor authentication and GitHub hardening measures.

The second group, UNC6040, has been active since October 2024 and is noted by Google as a financially motivated cluster engaging in vishing campaigns to hijack Salesforce instances. The FBI notes that attacks have used a modified Salesforce Data Loader and custom Python scripts to exfiltrate data, with extortion claims sometimes surfacing months after initial breaches, including ties to a further cluster tracked as UNC6240 and the ShinyHunters brand.