UNC6040
In 6 briefs, most recently 2 October 2025. RSS for this tag
Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗
Coverage in DanSec Daily
- Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
- Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
- Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
- Apple spyware alerts in France, FBI warning on Salesforce data theft by UNC6040/UNC6395, and CVE-2025-5086 exploitation in DELMIA Apriso.
- Sensata and UNFI breaches, critical Roundcube RCE CVE-2025-49113 actively exploited, and a Wazuh flaw exploited by Mirai botnets.
- Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.