The FBI’s September 2025 alert spotlights two advanced criminal operations, UNC6040 and UNC6395, whose tactics are redefining supply chain attacks and extortion across cloud CRMs, with Salesforce customers among the most impacted.

UNC6040: Vishing, OAuth Abuse, and Data Theft

Since October 2024, UNC6040 has spearheaded meticulously planned voice phishing (vishing) attacks targeting corporate help desks. The attackers impersonate IT support and trick staff into authorizing malicious “Connected Apps” within Salesforce, often cloned versions of Salesforce’s Data Loader app. This social engineering grants attackers OAuth tokens from Salesforce, which:

  • Blend malicious API traffic with legitimate user activity, hiding their operations.
  • Bypass multi-factor authentication (MFA) and password reset protections.
  • They are commonly registered through Salesforce trial accounts, complicating detection.

After gaining access, UNC6040 uses Python-based scripts to extract large volumes of sensitive CRM data, including names, email addresses, phone numbers, sales notes, and, in several high-profile breaches, financial and client-care information. Confirmed victims include Google (2.55 million records), Allianz Life (1.4 million customers), LVMH (Louis Vuitton, Dior, Tiffany), Adidas, Qantas, and Chanel’s US division.

Following data exfiltration, victims often receive extortion emails signed by the “ShinyHunters” threat actor group, demanding Bitcoin payments to prevent the public release of stolen data.

UNC6395: SaaS Interconnectivity Exploitation and Token Chain Attacks

In August 2025, UNC6395 revealed a new attack vector leveraging compromised OAuth tokens from the Drift AI chatbot, a Salesloft application deeply integrated with Salesforce. This campaign bypasses user credentials and malware by exploiting legitimate app sessions to:

  • Access Salesforce environments without triggering MFA alerts.
  • Move laterally to other SaaS platforms, including Google Workspace and Slack.
  • Exfiltrate further sensitive data such as API keys and cloud credentials.

This breach stemmed from a prolonged compromise of Salesloft’s GitHub repository between March and June 2025. Over 700 organizations were impacted, including major cybersecurity firms Zscaler and Palo Alto Networks. Salesforce and Salesloft have responded by revoking OAuth tokens and removing Drift from their AppExchange, illustrating the complex challenges of OAuth governance and multi-cloud supply chain security.

Indicators of Compromise (IOCs)

The FBI lists IOCs as markers for detecting and investigating potential compromise. These include:

  • IP Addresses: Servers used by attackers for phishing, exfiltration, and command-and-control traffic. Both UNC6040 and UNC6395 control a large, diverse set of IPs across multiple hosting providers and regions.
  • URLs/Links: Crafty web addresses resembling legitimate Salesforce environments or company portals, used for credential harvesting and malicious app authorization.
  • User-Agent Strings: Unique identifiers found in bulk data extraction scripts, signaling automation tools accessing Salesforce APIs undetected.

UNC6040 IOCs

  • IP Addresses: | IoC Type | Indicator | | — | — | | IP Address | 13.67.175[.]79 | | IP Address | 20.190.130[.]40 | | IP Address | 20.190.151[.]38 | | IP Address | 20.190.157[.]160 | | IP Address | 20.190.157[.]98 | | IP Address | 23.145.40[.]165 | | IP Address | 23.145.40[.]167 | | IP Address | 23.145.40[.]99 | | IP Address | 23.162.8[.]66 | | IP Address | 23.234.69[.]167 | | IP Address | 23.94.126[.]63 | | IP Address | 31.58.169[.]85 | | IP Address | 31.58.169[.]92 | | IP Address | 31.58.169[.]96 | | IP Address | 34.86.51[.]128 | | IP Address | 35.186.181[.]1 | | IP Address | 37.19.200[.]132 | | IP Address | 37.19.200[.]141 | | IP Address | 37.19.200[.]154 | | IP Address | 37.19.200[.]167 | | IP Address | 37.19.221[.]179 | | IP Address | 38.22.104[.]226 | | IP Address | 45.83.220[.]206 | | IP Address | 51.89.240[.]10 | | IP Address | 64.95.11[.]225 | | IP Address | 64.95.84[.]159 | | IP Address | 66.63.167[.]122 | | IP Address | 67.217.228[.]216 | | IP Address | 68.235.43[.]202 | | IP Address | 68.235.46[.]22 | | IP Address | 68.235.46[.]202 | | IP Address | 68.235.46[.]151 | | IP Address | 68.235.46[.]208 | | IP Address | 68.63.167[.]122 | | IP Address | 69.246.124[.]204 | | IP Address | 72.5.42[.]72 | | IP Address | 79.127.217[.]44 | | IP Address | 83.147.52[.]41 | | IP Address | 87.120.112[.]134 | | IP Address | 94.156.167[.]237 | | IP Address | 96.44.189[.]109 | | IP Address | 96.44.191[.]141 | | IP Address | 96.44.191[.]157 | | IP Address | 104.223.118[.]62 | | IP Address | 104.193.135[.]221 | | IP Address | 141.98.252[.]189 | | IP Address | 146.70.165[.]47 | | IP Address | 146.70.168[.]239 | | IP Address | 146.70.173[.]60 | | IP Address | 146.70.185[.]47 | | IP Address | 146.70.189[.]47 | | IP Address | 146.70.189[.]111 | | IP Address | 146.70.198[.]112 | | IP Address | 146.70.211[.]55 | | IP Address | 146.70.211[.]119 | | IP Address | 146.70.211[.]183 | | IP Address | 147.161.173[.]90 | | IP Address | 149.22.81[.]201 | | IP Address | 151.242.41[.]182 | | IP Address | 151.242.58[.]76 | | IP Address | 163.5.149[.]152 | | IP Address | 185.141.119[.]136 | | IP Address | 185.141.119[.]138 | | IP Address | 185.141.119[.]151 | | IP Address | 185.141.119[.]166 | | IP Address | 185.141.119[.]168 | | IP Address | 185.141.119[.]181 | | IP Address | 185.141.119[.]184 | | IP Address | 185.141.119[.]185 | | IP Address | 185.209.199[.]56 | | IP Address | 191.96.207[.]201 | | IP Address | 192.198.82[.]235 | | IP Address | 195.54.130[.]100 | | IP Address | 196.251.83[.]162 | | IP Address | 198.44.129[.]56 | | IP Address | 198.44.129[.]88 | | IP Address | 198.244.224[.]200 | | IP Address | 198.54.130[.]100 | | IP Address | 198.54.130[.]108 | | IP Address | 198.54.133[.]123 | | IP Address | 205.234.181[.]14 | | IP Address | 206.217.206[.]14 | | IP Address | 206.217.206[.]25 | | IP Address | 206.217.206[.]26 | | IP Address | 206.217.206[.]64 | | IP Address | 206.217.206[.]84 | | IP Address | 206.217.206[.]104 | | IP Address | 206.217.206[.]124 | | IP Address | 208.131.130[.]53 | | IP Address | 208.131.130[.]71 | | IP Address | 208.131.130[.]91 |
  • URLs/Links: | IoC Type | Indicator | | — | — | | URL | Login[.]salesforce[.]com/setup/connect?user_code=aKYF7V5N | | URL | Login.salesforce.com/setup/connect?user_code=8KCQGTVU | | URL | https://help[victim][.]com | | URL | https://login[.]salesforce[.]com/setup/connect | | URL | http://64.95.11[.]112/hello.php | | URL | 91.199.42.164/login |

UNC6395 IOCs

  • IP Addresses: | IoC Type | Indicator | | — | — | | IP Address | 208.68.36[.]90 | | IP Address | 44.215.108[.]109 | | IP Address | 154.41.95[.]2 | | IP Address | 176.65.149[.]100 | | IP Address | 179.43.159[.]198 | | IP Address | 185.130.47[.]58 | | IP Address | 185.207.107[.]130 | | IP Address | 185.220.101[.]33 | | IP Address | 185.220.101[.]133 | | IP Address | 185.220.101[.]143 | | IP Address | 185.220.101[.]164 | | IP Address | 185.220.101[.]167 | | IP Address | 185.220.101[.]169 | | IP Address | 185.220.101[.]180 | | IP Address | 185.220.101[.]185 | | IP Address | 192.42.116[.]20 | | IP Address | 192.42.116[.]179 | | IP Address | 194.15.36[.]117 | | IP Address | 195.47.238[.]83 | | IP Address | 195.47.238[.]178 |
  • User-Agent Strings: | IoC Type | Indicator | | — | — | | User-Agent | Salesforce-Multi-Org-Fetcher/1.0 | | User-Agent | Salesforce-CLI/1.0 | | User-Agent | python-requests/2.32.4 | | User-Agent | Python/3.11 aiohttp/3.12.15 |

How IOCs Are Used

  • Defenders should cross-check logs, API access trails, and traffic sources for any of these IPs, URLs, or user-agent strings. Their appearance may indicate attempted or successful intrusion linked to these threat groups.
  • Not all IOCs necessarily indicate compromise; each must be verified within the broader security context, as attackers frequently rotate their infrastructure.

Fluidity of Threat Groups and Ongoing Risks

INTELLIGENCE shows UNC6040’s activities overlap with “ShinyHunters” and link to the larger “Scattered LAPSUS$ Hunters” Telegram community, which openly targets data leaks and sells ransomware tools. Attempts at shutdowns by these groups often result in rebirths under new guises, signaling that ongoing vigilance is a necessity.

Practical Defensive Measures Recommendations by the FBI

  • Enhanced Security Awareness: Train help desk and call center staff specifically on the risks of vishing and app authorization fraud.
  • Phishing-Resistant MFA: Enforce strong multi-factor authentication across all cloud platforms and continuously monitor API and integration activity.
  • Vetting and Credential Hygiene: Rotate credentials and OAuth tokens frequently, thoroughly vet all third-party app integrations, and challenge any authorization requests received via phone.
  • Rapid Incident Response: Maintain and exercise playbooks for compromised integrations, considering downstream SaaS and user impacts.