Google Threat Intelligence Group (GTIG) has identified a financially motivated threat actor, UNC6040, actively conducting sophisticated voice phishing (vishing) campaigns aimed at breaching Salesforce instances. The primary objective is large-scale data theft, followed by extortion demands.

‍

Campaign Details:

• UNC6040 specializes in telephone-based social engineering, impersonating IT support personnel.
• Operators manipulate employees into granting access or sharing sensitive credentials.
• Recent incidents predominantly affect English-speaking employees of multinational corporations.

Attack Method:

• Threat actors trick employees into authorizing malicious "connected apps," commonly disguised as Salesforce's legitimate Data Loader tool.
• Victims are instructed via phone to authorize the malicious connected app through Salesforce’s setup page, inadvertently granting attackers extensive access rights.
• Attackers utilize modified versions of Salesforce's Data Loader to exfiltrate sensitive data from compromised environments.

Additional Insights:

• UNC6040 often employs Mullvad VPN IP addresses for unauthorized access and data exfiltration.
• Observed infrastructure includes phishing panels targeting Okta credentials.
• Extortion demands have surfaced months after initial breaches, suggesting collaboration with secondary threat actors monetizing stolen data. Threat actors occasionally claim affiliation with the ShinyHunters hacking group to heighten pressure.

Security Recommendations:

• Least Privilege Principle: Restrict permissions, especially the "API Enabled" permission required by tools like Data Loader.
• Implement Connected Apps Management: Limit connected app authorization strictly to necessary administrative personnel.
• IP-Based Restrictions: Enforce login restrictions to known, trusted enterprise IP ranges to mitigate unauthorized access.
• Advanced Monitoring: Utilize Salesforce Shield for enhanced visibility, transaction monitoring, and real-time security policy enforcement as well as saas security posture management solution.
• Multi-Factor Authentication (MFA): Implement robust MFA across all applications.

‍

Learn about securing Salesforce data and access with Nudge Security →