Salesforce platforms are being cracked open for data theft - FBI warns of UNC6040 and UNC6395 IOCs

Padlock against circuit board/cybersecurity background.

• Two threat groups, UNC6040 and UNC6395, are actively targeting Salesforce accounts to steal sensitive data
• UNC6395 exploits integrations like the Salesloft Drift chatbot, while UNC6040 uses phone-based social engineering to impersonate IT staff and gain access
• The FBI warns that follow-up extortion attacks are often carried out by ShinyHunters, linked to Scattered Spider

Two separate threat actors are currently targeting organizations’ Salesforce accounts to steal sensitive data found within. This is according to the US Federal Bureau of Investigation (FBI), which recently issued a FLASH advisory to warn businesses about the ongoing threat.