UNC6395
UNC6395 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in the United States. It uses 14 MITRE ATT&CK techniques.
- Techniques
- 14
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Countries · 1
About UNC6395.
A cybercriminal group attributed to a widespread data theft campaign targeting Salesforce instances by exploiting compromised OAuth tokens.
Last updated Jul 25, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.