FBI Cyber Division. (2025, September 12). Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion. Retrieved October 22, 2025.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1020 Automated Exfiltration |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors used API queries to automatically exfiltrate large volumes of data. |
| T1078.002 Domain Accounts |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors used compromised credentials for lateral movement. |
| T1083 File and Directory Discovery |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors queried customers' Salesforce environments to identify sensitive information for exfiltration. |
| T1567 Exfiltration Over Web Service |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors exfiltrated data via legitimate Salesforce API communication channels including the Salesforce Data Loader application. |
| T1587.001 Malware |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors created malicious applications within Salesforce trial accounts, typically Python scripts with similar function to the Salesforce Data Loader. |
| T1588.002 Tool |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors initially relied on the legitimate Salesforce Data Loader app for data exfiltration. |
| T1598.004 Spearphishing Voice |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors initiated voice calls with victims to socially engineer them into authorizing malicious applications or divulging sensitive credentials. |
| T1608.005 Link Target |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors established an Okta phishing panel which victims were tricked into accessing from mobile phones or work computers during social engineering calls. |
| T1671 Cloud Application Integration |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors deceived victims into authorizing malicious connected apps to their organization's Salesforce portal. |
| T1684.001 Impersonation |
CampaignSalesforce Data Exfiltration | During Salesforce Data Exfiltration, threat actors impersonated IT support personnel in voice calls with victims at times claiming to be addressing enterprise-wide connectivity issues. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
