Description Summary
Data-extortion (no encryption); tracked as UNC6040; core of Scattered Lapsus$ Hunters; 2025 Salesforce OAuth campaign.
Threat Actor
Tracked as UNC6040; core member of Scattered Lapsus$ Hunters; voice-phishing to attach malicious OAuth apps to Salesforce, then exfil + pivot to Okta/M365/S3. Victims incl. FedEx, Disney, Google, Cisco, Toyota, Marriott, Adidas.
Technical Indicators
Encryption Extension
N/A — data extortion (no encryption)
Encryption Algorithm
N/A
Ransom Note Name
N/A
Targeted Industries
Enterprise cloud/SaaS (cross-sector)
First Seen
~2020 (major 2025 Salesforce campaign)
Last Seen
Active (39+ orgs in 2025)
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |