UNC6395

• 9/14/2025

  FBI warns of Salesforce attacks by UNC6040 and UNC6395 groups

• 9/9/2025

  Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack

• 8/28/2025

  UNC6395 targets Salesloft in Drift OAuth token theft campaign