UNC6395
In 4 briefs, most recently 16 September 2025. RSS for this tag
Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗
Coverage in DanSec Daily
- Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
- Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
- Apple spyware alerts in France, FBI warning on Salesforce data theft by UNC6040/UNC6395, and CVE-2025-5086 exploitation in DELMIA Apriso.
- Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.