Threat Actor Unknown origin

UNC6040

UNC6040 is a financially motivated threat cluster that employs vishing to gain access to organizations' Salesforce environments, facilitating large-scale data exfiltration. The group manipulates end users into authorizing malicious connected apps, often masquerading as IT support personnel, to exploit OAuth permissions. Following initial access, UNC6040 leverages harvested credentials to move laterally within victim networks, targeting other cloud platforms like Okta and Microsoft 365. Their operations are characterized by the use of Mullvad VPN IP addresses and a focus on social engineering tactics to bypass security measures.

Indicators of Compromise 1

GitHub User GRUB1

MITRE ATT&CK TTPs 10

External Remote Services

Persistence

T1195.002

Compromise Software Supply Chain

Initial Access

T1212

Exploitation for Credential Access

Credential Access

T1213

Data from Information Repositories

Collection

T1499

Endpoint Denial of Service

Impact

T1558

Steal or Forge Kerberos Tickets

Source Articles

Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity

Microsoft has identified three attack paths used by threat actors associated with ShinyHunters to compromise Salesforce environments over a year-long campaign from mid-2025 to mid-2026. The attackers exploited trusted OAuth integrations through vishing attacks, stole OAuth tokens from compromised third-party vendors like Drift, Gainsight, and Klue, and abused misconfigured guest access in Salesforce Experience Cloud sites. These methods allowed persistent access to CRM data without exploiting platform vulnerabilities, blending malicious activity with legitimate traffic. The campaigns targeted organizations across retail, education, and manufacturing sectors, leveraging social engineering, supply chain compromises, and poor identity governance.

hacker-news ·2w ago