FBI Warns of Threat Actors Hitting Salesforce Customers

The FBI warned that two threat actors are targeting Salesforce customers for opportunities to steal data from and extort them.

The advisory, published Friday, comes courtesy of the FBI's Internet Crime Complaint Center (IC3) and concerns two threat actors: UNC6040 (also known as ShinyHunters) and UNC6395. UNC6040 is a threat actor that specializes in voice phishing or vishing and recently was observed using social engineering to pose as IT support staff to get into Salesforce environments. UNC6395, meanwhile, is best known for using stolen OAuth tokens from Salesloft's Drift application, which has a Salesforce integration, to steal sensitive data from hundreds of Salesforce environments earlier this year.

https://www.darkreading.com/cyberattacks-data-breaches/fbi-warns-threat-actors-salesforce-customers