Skip to content

CyberSIXT Search

Threat actor · coverage timeline

UNC6395

9 articles from 6 outlets between 28 Aug 2025 and 5 May. First reported by Security Affairs. The busiest day was Mon 15 Sep 2025, with 3 articles.

Articles: 9; all time · from 6 outlets
Days with coverage: 5; across 251 days
Busiest day: 3; articles on Mon 15 Sep 2025
Last 7 days: 0a day; vs 0 a day before
First report: 28 Aug 2025; Security Affairs
CVEs named: 0; in these articles

Coverage over time

9 articles · 28 Aug 2025 – 5 May

28 Aug 2025First report28 Aug 2025 · Security Affairs

Show as table

UNC6395: articles per day
Day (UTC)	Articles	Outlets
Thu 28 Aug 2025	1	Security Affairs 1
Mon 8 Sep 2025	1	Security Affairs 1
Sat 13 Sep 2025	3	The Hacker News 1, DataBreaches 1, Security Affairs 1
Mon 15 Sep 2025	3	SecurityOnline 1, BleepingComputer 1, SecurityWeek 1
Tue 5 May	1	The Hacker News 1

Articles

9 articles

Tue 5 May1 article

12:58
Persistent OAuth Tokens Pose Rising Threat as AI Apps MultiplyThe Hacker News

Mon 15 Sep 2025 20253 articles

11:25
FBI Shares IoCs for Recent Salesforce Intrusion CampaignsSecurityWeek
04:55
FBI warns of UNC6040, UNC6395 hackers stealing Salesforce dataBleepingComputer
02:15
FBI Alert: Two Cybercriminal Groups Are Actively Compromising SalesforceSecurityOnline

Sat 13 Sep 2025 20253 articles

19:56
FBI warns of Salesforce attacks by UNC6040 and UNC6395 groupsSecurity Affairs
14:56
FBI Flash Alert: Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and ExtortionDataBreaches
09:40
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft AttacksThe Hacker News

Mon 8 Sep 2025 20251 article

20:25
Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attackSecurity Affairs

Thu 28 Aug 2025 20251 article

10:15
UNC6395 targets Salesloft in Drift OAuth token theft campaignSecurity Affairs · first report