FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United States
Federal Bureau of Investigation
CONFIRMED89% CONFIDENCEThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
1.00