UNC6040 Archives - Recon Bee

Two threat clusters, identified as UNC6040 and UNC6395, are breaching Salesforce environments of enterprises in order to steal data and extort victims, according to a FLASH alert released by the FBI. According to the FBI's FLASH advisory, the agency is releasing this FLASH to share Indicators of Compromise (IOCs) linked to recent malevolent cyber activity by cybercriminal organizations UNC6040 and UNC6395, which are in charge of an increasing number of data theft and extortion intrusions. Both groups have lately been seen using various initial access methods to target Salesforce platforms used by enterprises. In order to raise awareness and give recipients IOCs that they may use for network defense and study, the FBI is making this information public. Google Threat Intelligence (...

Google revealed information on a financially driven threat cluster that "specializes" in voice phishing (also known as vishing) attacks intended to compromise Salesforce instances of businesses in order to steal massive amounts of data and then extort victims. Under the alias UNC6040, the internet giant's threat intelligence team is monitoring the activity, which it claims demonstrates traits similar to threat organizations connected to an online cybercrime collective called The Com. According to a report provided to The Hacker News, UNC6040 has repeatedly succeeded in accessing networks over the last few months by using its operators to pose as IT support staff in convincing phone-based social engineering engagements. According to Google's Threat Intelligence Group (GTIG), this ...

Tag: UNC6040

FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data

Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App