Threat Research

This FLASH is being issued to share Indicators of Compromise (IOCs) linked to recent malicious cyber activities carried out by cybercriminal groups UNC6040 and UNC6395. These groups are responsible for a growing number of data theft and extortion incidents and have recently been observed targeting organizations' Salesforce platforms through various initial access methods....

The team identified threat actor activity exploiting the Salesloft-Drift integration to breach Salesforce instances. From August 8–18, 2025, compromised OAuth credentials were used to exfiltrate sensitive Salesforce data. The actor targeted objects like Account, Contact, Case, and Opportunity, and scanned for credentials post-exfiltration....