FBI Alert: UNC6040 and UNC6395 Threat Actors Exploiting Salesforce Platforms for Data Theft

The U.S. Federal Bureau of Investigation (FBI) has issued a critical flash alert warning organizations about cybercriminal groups UNC6040 and UNC6395. These threat actors are actively targeting Salesforce platforms in data theft and extortion campaigns. The FBI released indicators of compromise (IoCs) to help organizations detect and mitigate these threats.

UNC6040 and UNC6395 employ various initial access mechanisms to infiltrate Salesforce environments. Their tactics include phishing, credential stuffing, and exploiting misconfigurations in Salesforce setups. Once inside, they exfiltrate sensitive data and often deploy ransomware or engage in extortion.

Salesforce platforms are attractive targets due to the vast amounts of customer, financial, and proprietary data they store. A compromised Salesforce instance can lead to severe data breaches, regulatory fines, and reputational damage.

Organizations using Salesforce should immediately review their security posture. Key recommendations include enabling multi-factor authentication (MFA), regularly auditing user permissions, and monitoring for suspicious activity. The FBI’s IoCs provide specific patterns to look for, such as unusual login attempts, unexpected data exports, and anomalous API calls.

Additionally, businesses should ensure their Salesforce configurations follow security best practices. This includes restricting access to sensitive data, implementing IP whitelisting, and using encryption for data at rest and in transit. Regular security training for employees can also reduce the risk of phishing attacks.

The FBI advises organizations to share any related threat information with their local field office or via the Internet Crime Complaint Center (IC3). Collaboration and information sharing are crucial in combating these evolving threats.

Staying informed about the latest cyber threats and proactive security measures is essential. By heeding the FBI’s warning and implementing robust defenses, organizations can protect their Salesforce platforms from UNC6040 and UNC6395 and similar threat actors.