FBI Warns of Salesforce Attacks: UNC6040 & UNC6395 Target SaaS Platforms

 Executive Summary

The FBI has issued a high-priority FLASH alert (FLASH-20250912-001) warning enterprises worldwide of active cyberattacks targeting Salesforce environments.

Two threat groups — UNC6040 and UNC6395 — are leveraging a mix of spear-phishing, vishing (voice phishing), and OAuth exploit kits to infiltrate Salesforce platforms, exfiltrate sensitive data, and extort victims.

For organizations running SaaS applications at scale, this is a wake-up call: SaaS isn’t “set and forget.” Attack surfaces have shifted from on-prem servers to integrations, APIs, and OAuth tokens.

In this CyberDudeBivash ThreatWire edition, we deliver a deep-dive analysis of these attacks, technical details, and actionable defense playbooks.

1. The Threat Groups: UNC6040 & UNC6395

UNC6040 – Social Engineering Specialists

• Since late 2024, UNC6040 has been running vishing campaigns against corporate help desks.

• Attackers impersonate IT staff, tricking employees into granting Salesforce access or installing malicious connected apps.

• They often push a modified version of Salesforce’s Data Loader tool, enabling mass data exfiltration.

• Once inside, they steal CRM datasets, pipeline forecasts, customer PII, and financial records.

• UNC6040 often delays extortion demands for weeks, leveraging stolen data strategically.

UNC6395 – OAuth Token Abusers

• Exploited OAuth tokens tied to Salesloft Drift, a chatbot integration for Salesforce.

• Tokens were used to silently siphon CRM data without triggering traditional MFA alerts.

• Salesforce + Salesloft revoked all active/refresh Drift tokens on Aug 20, 2025, but the attack showed how OAuth trust chains can be abused.

• UNC6395 represents a new breed of SaaS attackers focusing on token persistence and API exploitation.

2. Why Salesforce?

Salesforce isn’t just a CRM. It is the customer intelligence core for global enterprises:

• Customer contact details

• Account financial history

• Deal pipelines

• Marketing campaigns

• Partner ecosystem data

Compromising Salesforce = compromising the heart of B2B and B2C operations. For attackers, this is data goldmine + extortion leverage.

3. Attack Tactics in Detail

UNC6040 TTPs

• Initial Access: Vishing help desks, fake tickets, phishing emails.

• Execution: Malicious Data Loader app, or connected app authorization.

• Persistence: OAuth token abuse, API key storage.

• Exfiltration: Salesforce API queries → bulk download customer datasets.

• Extortion: Data leak threats, ransom demands (sometimes under ShinyHunters alias).

UNC6395 TTPs

• Initial Access: OAuth token compromise via Salesloft Drift.

• Execution: API-level access, bypassing MFA.

• Persistence: Refresh token reuse.

• Exfiltration: Silent CRM data siphoning.

• Mitigation Trigger: Salesforce revoked Drift app tokens on Aug 20, 2025.

4. Technical Indicators of Compromise (IOCs)

The FBI report provided multiple IOCs:

• Suspicious user-agent strings.

• Malicious connected app domains.

• Unusual API request patterns.

• IP addresses associated with known UNC6040 servers.

CyberDudeBivash ThreatWire subscribers can request the full IOC set via our SOC integration pack.

5. Business Impact

• Financial Losses: CRM data is tied to revenue forecasting and sales strategies. Theft disrupts business pipelines.

• Regulatory Risk: Breaches = GDPR, HIPAA, PCI fines.

• Reputation Damage: Exposed customer data = loss of trust.

• Supply Chain Exposure: Partner and vendor data also stored in Salesforce → secondary breaches possible.

6. FBI Recommendations

• Audit Connected Apps: Disable any suspicious or unused integrations.

• Enforce Strong MFA: Phishing-resistant MFA for Salesforce logins.

• Monitor OAuth Tokens: Rotate, revoke unused, audit scopes.

• Help Desk Training: Teach staff to detect vishing attempts.

• Log Analysis: Watch for anomalies in Salesforce API calls.

7. CyberDudeBivash Defense Playbook

At CyberDudeBivash, we recommend a 3-Layer SaaS Defense Strategy:

1. Identity Layer

   • Phishing-resistant MFA

   • Continuous Identity Threat Detection (ITDR)

2. Application Layer

   • SaaS Security Posture Management (SSPM)

   • Connected App governance

   • API behavior analytics

3. Threat Intel Layer

   • IOC feeds integrated into SIEM/SOAR

   • SaaS breach playbooks for SOCs

   • Continuous red-teaming of SaaS apps

8. CyberDudeBivash Insights & Apps

SessionShield – Protects SaaS sessions & tokens against hijacks.
PhishRadar AI – Identifies phishing/vishing campaigns targeting SaaS logins.
Threat Analyser App – SaaS breach playbooks + IOC integration.

 Explore at: cyberdudebivash.com/apps

9. Closing Thoughts

The FBI’s Salesforce alert signals a paradigm shift in cybercrime: attackers are moving from endpoints and servers → into cloud SaaS ecosystems.

CRM platforms like Salesforce are crown jewels. Protecting them requires zero trust principles, SaaS-specific threat intel, and human awareness training.

CyberDudeBivash ThreatWire will continue to bring you authoritative, Adsense-safe cyber intelligence.

 Call to Action

• CVEs & daily intel → cyberbivash.blogspot.com

• Cybercrime & AI tech → cyberdudebivash-news.blogspot.com

• Crypto/DeFi breaches → cryptobivash.code.blog

• Apps & services → cyberdudebivash.com

#CyberDudeBivash #ThreatWire #Salesforce #FBIAlert #UNC6040 #UNC6395 #OAuth #SaaSSecurity #Phishing #DataExfiltration #ThreatIntel