UNC6040
UNC6040 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 23 MITRE ATT&CK techniques and exploits 3 known CVEs.
- Techniques
- 23
- Exploited CVEs
- 3
- First seen
- Jun 5, 2025
- Last seen
- Dec 31, 2025
- Record updated
About UNC6040.
A financially motivated threat cluster, active since October 2024, engaged in vishing campaigns for initial access to Salesforce instances for data theft and extortion.
Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.