Threat actor
UNC6040
financial
Tracked by CyberSIXT since 13 Sep 2025
- Articles · all time
- 9
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 2
9 articles from 8 outlets since 13 Sep 2025; the latest 387 days ago.
- Article
- Research report
Show as table
Who reported 8 outlets
- Dark Reading2
- The Hacker News1
- DataBreaches1
- Security Affairs1
- SecurityOnline1
- BleepingComputer1
- SecurityWeek1
- GBHackers1
Names and sources
- UNC6040
- Named by CyberSIXT coverage
- UNC6040
- Named by Malpedia · unc6040
- Storm-2581
- Named by Microsoft · Storm-2581
- UNC6040
- Named by Microsoft · Storm-2581
- UNC6040
- Named by MISP Galaxy · 84669320-0b46-4b26-a063-fb71e9833fec
- 84669320-0b46-4b26-a063-fb71e9833fec
- Named by CyberSIXT coverage
Attributed facts
- category
- financial (Microsoft · Storm-2581)
- motivation
- financial (Microsoft · Storm-2581)
- Scattered Lapsus$ Hunters Returns With Salesforce Leak SiteDark Reading
- Google Sheds Light on ShinyHunters' Salesforce TacticsDark Reading
- Google Publishes Security Hardening Guide to Counter UNC6040 ThreatsGBHackers
- FBI Shares IoCs for Recent Salesforce Intrusion CampaignsSecurityWeek
- FBI warns of UNC6040, UNC6395 hackers stealing Salesforce dataBleepingComputer
- FBI Alert: Two Cybercriminal Groups Are Actively Compromising SalesforceSecurityOnline
- FBI warns of Salesforce attacks by UNC6040 and UNC6395 groupsSecurity Affairs
- FBI Flash Alert: Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and ExtortionDataBreaches
- FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft AttacksThe Hacker News · first in our coverage