Threat actor
UNC6395
Tracked by CyberSIXT since 28 Aug 2025 · last activity 5 May
- CVEs exploited · attributed
- 0
- CVEs also mentioned · not attributed
- 0
- articles · all time
- 7
No articles in the last 45 daysThe latest: The Hacker News, Tue 5 May, 12:58 UTC.See the full timeline
CVEs
No CVE is named alongside UNC6395 in CyberSIXT coverage.
- Persistent OAuth Tokens Pose Rising Threat as AI Apps MultiplyThe Hacker News
- FBI Shares IoCs for Recent Salesforce Intrusion CampaignsSecurityWeek
- FBI warns of UNC6040, UNC6395 hackers stealing Salesforce dataBleepingComputer
- FBI Alert: Two Cybercriminal Groups Are Actively Compromising SalesforceSecurityOnline
- FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft AttacksThe Hacker News
- Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attackSecurity Affairs
- UNC6395 targets Salesloft in Drift OAuth token theft campaignSecurity Affairs · first in our coverage