CYBERCRIME OBSERVATIONS FROM THE FRONTLINES: UNC6040 PROACTIVE HARDENING RECOMMENDATIONS

Summary from the TLDR InfoSec newsletter

UNC6040 is a financially motivated threat group that uses voice phishing (vishing) to trick employees into authorizing malicious Salesforce Data Loader applications, enabling large-scale data theft from corporate Salesforce instances. The attackers impersonate IT support personnel to manipulate victims into granting OAuth access to fake connected apps, then systematically exfiltrate sensitive data using legitimate Salesforce tools. Organizations should implement phishing-resistant MFA, restrict API access to approved applications only, enforce network-based login restrictions, and deploy real-time detection rules that monitor for suspicious OAuth authorizations followed by bulk data exports.