Threat Cluster Profile: Salesforce-Focused Vishing & Data Extortion

UNC6040

Google Threat Intelligence Group designation · extortion handoff observed to UNC6240 / ShinyHunters

Threat Level: High

Section 01

Actor Profile

Key Findings

OriginUncategorized cluster designation used by Google Threat Intelligence Group, publicly disclosed June 2025; not yet linked to a named, persistent group.
Primary TargetOrganizations running Salesforce CRM environments, with access gained by targeting English-speaking employees via phone.
Initial AccessVishing calls impersonating internal IT support, tricking employees into authorizing a fake "Data Loader" connected app via OAuth Device Flow.
Primary ObjectiveBulk theft of CRM customer and contact data, later handed off to a separate persona (UNC6240 / ShinyHunters) for extortion.
Operating MethodExfiltrates data in slow, incremental batches designed to resemble routine sync activity, routing calls and data movement through VPNs and Tor to mask origin.
Defense PrioritiesRestrict self-authorization of connected apps, require live video verification for help desk requests, and monitor for anomalous Data Loader / API bulk exports.

Section 02

Kill Chain & MITRE ATT&CK Mapping

The entire intrusion can happen without a single line of malware touching the victim's endpoint. The weapon is a phone call and a Salesforce connected-app authorization screen.

Reconnaissance

Gather Victim Org Information

Operators research a target's org chart and IT support process closely enough to sound credible on a cold call, often using pre-recorded automated phone menus to extract further detail beforehand.

Analyst Note

Before ever making contact, they study your company well enough to sound convincing on the phone.

Initial Access

Spearphishing Voice (Vishing)

A caller impersonating internal IT support convinces an English-speaking employee to navigate to Salesforce's connected-app authorization page.

Steal Application Access Token

The operator pre-configures OAuth Device Flow through a local, actor-controlled Data Loader build and generates a short device code; once the victim enters that code and approves the app, an access token is issued directly to the attacker's instance.

Analyst Note

A caller poses as IT support and talks an employee into approving a fake app — no malware needed, just a phone call.

Defense Evasion

Disguised Connected Application

The malicious app is styled to resemble Salesforce's legitimate Data Loader tool, so its presence in the connected-apps list does not immediately stand out to an administrator.

Anonymization Infrastructure

Vishing calls have been placed through VPN-anonymized voice services, and follow-on data movement has used Tor, obscuring the operators' true location and call origin.

Analyst Note

The fake app is built to look like a real Salesforce tool, and calls are routed through anonymizing services to hide who's really calling.

Collection & Exfiltration

Data from Cloud Storage

All subsequent actions run on behalf of the victim's approved session, allowing the attacker's Data Loader instance to pull CRM records in small, slow chunks that resemble routine sync activity rather than a single bulk export.

Lateral Pivot via Compromised Mailbox

In some intrusions, access to a compromised employee mailbox has been reused to send further phishing emails to the victim's own contacts, with the sent messages deleted afterward to cover the trail.

Analyst Note

They pull your CRM data out slowly, in small batches designed to look like normal syncing rather than a big theft.

Impact

Extortion Handoff

Stolen data is handed off for the extortion phase, typically executed under the separately tracked UNC6240 / ShinyHunters persona, with a rapid payment deadline used to pressure the victim.

Analyst Note

The stolen data gets handed to a separate group for the extortion demand, usually with a tight deadline to pressure payment.

Section 03

Indicators of Compromise

UNC6040's footprint lives almost entirely in Salesforce audit and connected-app logs rather than on the endpoint. These are the publicly reported signals worth hunting for.

Reported patterns & behavior

Indicator / Behavior	Type	Notes
Unfamiliar "Data Loader" style connected app authorized	App / integration	The core initial access vector; verify against Salesforce's genuine published app
OAuth device code entered shortly after an unsolicited IT support call	Behavior	Matches the reported device-flow abuse pattern
Slow, incremental bulk record exports from CRM objects	Behavior	Designed to resemble routine sync traffic rather than a single large pull
Calls originating through VPN-anonymized voice services	Infrastructure	Reported use of commercial VPN providers to mask call origin
Outbound data movement over Tor following a Salesforce session	Infrastructure	Used to anonymize exfiltration destination
Rapid-deadline extortion email citing a 72 hour payment window	Behavior	Typically arrives from a separate persona, not the intrusion actor

Analyst Note

None of these indicators are unique on their own, but a new connected app followed by slow, incremental exports is a strong combined signal of this cluster's tradecraft.

Section 04

Detection & Mitigation Priorities

Drawn directly from Mandiant's published UNC6040 hardening guidance, ordered by impact-to-effort ratio.

P1Restrict which connected apps employees can self-authorize in Salesforce, and require admin review for anything requesting bulk data export scope.
P1Require a live video call to verify identity for any help desk request involving credential reset or new app authorization, not a callback alone.
P1Monitor and alert on Data Loader / API-driven bulk exports outside expected integration behavior, especially from new or recently authorized apps.
P2Harden and rotate programmatic credentials — API keys, OAuth tokens, service accounts — on a defined schedule rather than indefinitely.
P2Enable and centrally log Salesforce Event Monitoring for connected-app authorizations and large report or API exports.
P3Pre-brief employees on the specific Data Loader vishing script so a call requesting connected-app approval is treated as suspicious by default.

Analyst Note

Locking down who can approve connected apps and verifying help desk calls by video stops this attack at its only real entry point — the phone call.

Section 05

References

01Salesforce Data Exfiltration, Campaign C0059MITRE ATT&CK
02Cybercrime Observations from the Frontlines: UNC6040 Proactive Hardening RecommendationsMandiant / Google Cloud
03Technical Analysis: The Persistent Threat of Vishing AttacksGoogle Threat Intelligence Group
04Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader AppThe Hacker News
05Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS PlatformsThe Hacker News
06Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce InstancesFBI / IC3
07UNC6040 (Threat Actor)Malpedia