FBI Issues Alert on Cybercriminal Groups Targeting Salesforce Platforms
September 13, 2025
In a concerning development, the Federal Bureau of Investigation (FBI) has issued a flash alert regarding two cybercriminal factions, referred to as UNC6040 and UNC6395, who are orchestrating a series of data theft and extortion attacks. This alert highlights significant vulnerabilities in Salesforce platforms, which these groups have been actively exploiting using various initial access methods.
Recently, UNC6395 has been linked to a widespread campaign targeting Salesforce instances, with notable activity reported in August 2025. The group leveraged compromised OAuth tokens associated with the Salesloft Drift application to gain unauthorized access to sensitive data. A subsequent investigation revealed that this breach originated from a compromise of Salesloft’s GitHub account that occurred between March and June 2025. In response, Salesloft has taken decisive actions by isolating the affected Drift infrastructure and temporarily deactivating their AI chatbot application.
Salesloft’s actions follow a broader trend observed by the FBI, as cybercriminals increasingly focus on exploiting popular business platforms. The use of compromised tokens to penetrate Salesforce environments indicates a sophisticated understanding of the platform’s security architecture. This incident underscores the importance of robust security measures, particularly in light of attack vectors that utilize previous breaches of third-party systems.
The tactics employed by UNC6395 align with several methods identified within the MITRE ATT&CK framework, suggesting a calculated approach to their operations. The initial access tactic, primarily through social engineering and exploitation of vulnerable third-party services, is evident in this scenario. Moreover, the persistent nature of the breach could indicate ongoing attempts to maintain access to compromised environments, thereby posing a continuous threat to affected organizations.
As businesses increasingly rely on cloud-based applications such as Salesforce, the potential for these types of attacks only grows. Organizations are urged to enhance their security postures by implementing multi-factor authentication and regularly reviewing access controls to sensitive applications. Ongoing security training for employees can also serve as a crucial line of defense against social engineering attacks that often precede such breaches.
The FBI’s alert serves as a crucial reminder of the evolving landscape of cyber threats. As cybercriminals refine their tactics, business owners must remain vigilant in safeguarding their data and systems. The importance of understanding the attack vectors highlighted by this incident cannot be overstated, as it provides critical insight into the necessary steps for preventing similar occurrences in the future.