Decision question

What is confirmed about this campaign, how does it gain access and create impact, who and what are in scope, what remains unknown, and which defensive actions follow from the retained evidence?[1][2][3][4]

Interpreted questions

Review access prerequisites, reachability, exploitation, affected technology, actors, victims, timeline, tradecraft, impact, attribution boundaries, mitigation, and related IntelliOS coverage.[1][2][3][4]

Initial observations

The Salesforce Data Exfiltration campaign began in October 2024 with financially-motivated threat actor UNC6040 using Spearphishing Voice (vishing) to compromise corporate Salesforce instances for large-scale data theft and extortion. Following the initial data theft, victim organizations received extortion demands from a separate threat actor, UNC6240, who claimed to be the “ShinyHunters” group. The observed infrastructure and TTPs used during the Salesforce Data Exfiltration campaign overlap with those used by threat groups with suspected ties to the broader collective known as "The Com.” These overlaps could plausibly be the result of associated actors operating within the same communities and are not necessarily an indication of a direct...[1][2][3][4]

Evidence hierarchy and boundary

MITRE campaign mapping with FBI and Google threat-intelligence reporting Campaign row is compressed for directory seeding. Confirm actor linkage, infrastructure, and targeting with source-specific reports and local telemetry.[1][2][3][4]

The Salesforce Data Exfiltration campaign began in October 2024 with financially-motivated threat actor UNC6040 using Spearphishing Voice (vishing) to compromise corporate Salesforce instances for large-scale data theft and extortion. Following the initial data theft, victim organizations received extortion demands from a separate threat actor, UNC6240, who claimed to be the “ShinyHunters” group. The observed infrastructure and TTPs used during the Salesforce Data Exfiltration campaign overlap with those used by threat groups with suspected ties to the broader collective known as "The Com.” These overlaps could plausibly be the result of associated actors operating within the same communities and are not necessarily an indication of a direct...[1][2][3][4]

Potential espionage, credential theft, operational disruption, or data exposure depending on campaign objective.[1][2][3][4]

Map local telemetry to the listed ATT&CK techniques before assuming exposure. Review identity, endpoint, network egress, and cloud audit evidence for campaign-specific behavior. Keep attribution and victimology source-bound unless corroborated by local evidence.[1][2][3][4]

The Salesforce Data Exfiltration campaign began in October 2024 with financially-motivated threat actor UNC6040 using Spearphishing Voice (vishing) to compromise corporate Salesforce instances for large-scale data theft and extortion. Following the initial data theft, victim organizations received extortion demands from a separate threat actor, UNC6240, who claimed to be the “ShinyHunters” group. The observed infrastructure and TTPs used during the Salesforce Data Exfiltration campaign overlap with those used by threat groups with suspected ties to the broader collective known as "The Com.” These overlaps could plausibly be the result of associated actors operating within the same communities and are not necessarily an indication of a direct...

The retained record scopes this as cybercrime activity during 2004-10-01 to 2025-09-01. Potential espionage, credential theft, operational disruption, or data exposure depending on campaign objective.[1][2][3][4]

Map local telemetry to the listed ATT&CK techniques before assuming exposure. Review identity, endpoint, network egress, and cloud audit evidence for campaign-specific behavior. Keep attribution and victimology source-bound unless corroborated by local evidence.[1][2][3][4]

Confirmed reporting is separated from attribution, victim, and prevalence claims that the retained sources do not establish. Confidence: High for MITRE-tracked campaign metadata and ATT&CK relationships; operational currentness should be validated..[1][2][3][4]