FBI Flash Alert: Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion

According to Federal Bureau of Investigation (FBI), the FBI has issued a Flash Alert detailing malicious activity by cyber criminal groups UNC6040 and UNC6395, described as responsible for a rising number of data theft and extortion intrusions. The alert, published as Flash Alert-20250912-001, notes that both groups have recently been observed targeting organisations’ Salesforce platforms through different initial access mechanisms.

It explains that the FBI is releasing the information to maximise awareness and to provide Indicators of Compromise (IOCs) that may assist recipients with research and network defence. The article outlining the alert is dated 13 September 2025. DataBreaches[.]Net positions the report as a summary of the FBI’s guidance, emphasising the focus on Salesforce as a target for data theft and extortion.

While the piece connects the two groups to Salesforce intrusions, it presents these as claims within the Flash Alert rather than independently verified statements.