UNC6040 or UNC6240
UNC6040 or UNC6240 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 2 MITRE ATT&CK techniques.
- Techniques
- 2
- Exploited CVEs
- No CVE data
- First seen
- Sep 1, 2025
- Last seen
- Sep 1, 2025
- Record updated
About UNC6040 or UNC6240.
Threat actors responsible for the Salesforce data theft attacks, using social engineering and voice phishing to trick employees into linking malicious OAuth apps for data exfiltration.
Last updated Jul 24, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.