The FBI on Friday released an alert warning that two hacker groups have been targeting Salesforce instances for extortion and data theft.
The groups, identified as UNC6040 and UNC6395, have been identified in recent attacks using different methods of gaining initial access, according to the FBI. The alert includes indicators of compromise and additional guidance that can help security teams determine if they have been targeted and prevent future attacks.
UNC6040 has used voice phishing in order to gain access to the Salesforce accounts of targeted organizations. Since October 2024, the group has used social-engineering tactics to get customer-support agents to hand over employee credentials, according to the alert.
Salesforce previously warned about these social engineering attacks in March, and researchers from Google Threat Intelligence Group warned about UNC6040 in June.
The FBI said some victims have received extortion demands from hackers calling themselves ShinyHunters. The demands have arrived between several days and several months after the breaches.
The attacks from UNC6395 relied on compromised OAuth tokens for Salesloft Drift, an AI-based chatbot that was integrated with Salesforce. The hackers in these attacks stole data after compromising victims’ Salesforce instances.
By late August, the companies had revoked all active access and refreshed their tokens, preventing the hackers from further accessing Salesforce platforms through Salesloft Drift, according to the FBI.
The supply chain attacks potentially affected hundreds of organizations, and multiple security companies disclosed potential breaches of their customers.
Security researchers told Cybersecurity Dive that a threat group claiming ties to ShinyHunters, Scattered Spider and Lapsus$ — which claimed responsibility for hacking Jaguar Land Rover and other high-profile targets — has taken down its Dark Web sites in recent days.
The company has not publicly discussed how hackers gained access to its systems, but it did previously confirm that it was investigating the threat claims.
Researchers suspect that move is related to increased law-enforcement activity, but it remains unclear if authorities have arrested any of the hackers. Experts also said the attackers are likely to rebrand under a different name rather than completely cease their activities.
It is not clear whether the attack on JLR is related to the activity described in the FBI alert. The bureau did not respond to a request for comment.
