The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organizations’ Salesforce environments to steal data and extort victims.

“The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate Indicators of Compromise (IOCs) associated with recent malicious cyber activities by cyber criminal groups UNC6040 and UNC6395, responsible for a rising number of data theft and extortion intrusions,” reads the FBI’s FLASH advisory.

“Both groups have recently been observed targeting organizations’ Salesforce platforms via different initial access mechanisms. The FBI is releasing this information to maximize awareness and provide IOCs that may be used by recipients for research and network defense.”

UNC6040 was first disclosed by Google Threat Intelligence (Mandiant) in June, who warned that since late 2024, threat actors were using social engineering and vishing attacks to trick employees into connecting malicious Salesforce Data Loader OAuth apps to their company’s Salesforce accounts.

In some cases, the threat actors impersonated corporate IT support personnel, who used renamed versions of the application called “My Ticket Portal.”

Once connected, the threat actors used the OAuth application to mass-exfiltrate corporate Salesforce data, which was then used in extortion attempts by the ShinyHunters extortion group.

In these early data theft attacks, ShinyHunters told BleepingComputer that they primarily targeted the “Accounts” and “Contacts” database tables, which are both used to store data about a company’s customers.

These data theft attacks were widespread, impacting large and well-known companies, such as Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, and Tiffany & Co.

Later data theft attacks in August also targeted Salesforce customers, but this time utilized stolen Salesloft Drift OAuth and refresh tokens to breach customers’ Salesforce instances.

This activity is tracked as UNC6395 and is believed to have occurred between August 8th and 18th, with the threat actors using the tokens to target the company’s support case information that was stored in Salesforce.

The exfiltrated data was then analyzed to extract secrets, credentials, and authentication tokens shared in support cases, including AWS keys, passwords, and Snowflake tokens. These credentials could then be used to pivot to other cloud environments for additional data theft.

Salesloft worked with Salesforce to revoke all Drift tokens and required customers to reauthenticate to the platform.

It was later revealed that the threat actors also stole Drift Email tokens, which were used to access emails for a small number of Google Workspace accounts.

An investigation by Mandiant determined the attack originated in March, when Salesloft’s GitHub repositories were compromised, allowing attackers to ultimately steal the Drift OAuth tokens.

Like the previous attacks, these new Salesloft Drift data theft attacks impacted numerous companies,  including Cloudflare, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Nutanix, Qualys, Rubrik, Cato Networks, Palo Alto Networks, and many more.

While the FBI did not name the groups behind these campaigns, BleepingComputer was told by the ShinyHunters extortion group that they and other threat actors calling themselves “Scattered Lapsus$ Hunters, were behind both clusters of activity.

This group of hackers claims to have originated from and overlap with the Lapsus$, Scattered Spider, and ShinyHunters extortion groups.

On Thursday, the threat actors announced via a domain associated with BreachForums that they planned to “go dark” and stop discussing operations on Telegram.

However, in a parting post, the hackers claimed to have gained access to the FBI’s E-Check background check system and Google’s Law Enforcement Request system, publishing screenshots as proof.

If legitimate, this access would allow them to impersonate law enforcement and pull sensitive records of individuals.

When contacted by BleepingComputer, the FBI declined to comment, and Google did not respond to our email.

The US Justice Department has closed its investigation into Kraken’s founder Jesse Powell, and returned dozens of laptops and mobile phones agents seized during an FBI raid two years ago, Fortune reported on July 22.

The federal case did not revolve around Kraken’s operations, but rather a bitter governance fight at the Verge Center for the Arts, a Sacramento nonprofit Powell founded in 2008.

News of the raid first surfaced in The New York Times, which reported that agents were probing allegations Powell had “hacked and cyber-stalked” the nonprofit.

Court filings since then depict something far less cinematic: a dispute over who controlled Slack and Google Workspace accounts after Powell was pushed off Verge’s board. 

Powell insisted he never cut off anyone’s access and argues instead that Verge insiders quietly created a new domain and parallel work accounts before moving to oust him. 

He is pursuing a civil lawsuit in state court, accusing former colleagues of defamation and wrongful removal.

Justice Department drops the case

Documents Powell filed this week include a so-called declination letter from prosecutors, confirming the Justice Department has walked away from the case.

His attorney said he requested the letter to counter the reputational damage caused by the raid and to reassure banks and regulators that Kraken’s leadership is not under federal scrutiny. 

Powell called the search “devastating” personally and professionally, maintaining that discovery in his lawsuit has already shown the accusations to be baseless.

The government’s exit does not resolve lingering questions. Neither the Justice Department nor the FBI would comment on how the Times obtained details of the investigation.

Powell’s latest filings also accuse two Verge board members, one of them attorney Phil Cunningham, of withholding key documents during discovery. 

Verge, meanwhile, continues to operate as a fixture of Sacramento’s arts scene, supported over the years by more than $1 million in donations and extensive tech assistance from Powell. 

Notably, Powell declined to say whether the returned devices held Bitcoin or other digital assets. When agents seized the hardware, Bitcoin (BTC) traded near $23,000. As of press time, BTC trades near $119,000.

Mentioned in this article

The Federal Bureau of Investigation has implicated North Korean-backed hacking groups in a major cryptocurrency heist involving $1.5 billion in digital assets.

The cyberattack targeted Bybit, a Dubai-based cryptocurrency exchange, making it one of the largest crypto thefts publicly known. This incident has drawn attention to North Korea’s ongoing role in cyber-enabled financial crimes.

FBI Blames North Korean Hackers for $1.5 Billion Crypto Heist

The hackers—identified as TraderTraitor and the Lazarus Group—allegedly deployed malware through modified cryptocurrency trading applications, allowing them to seize Ethereum and convert it into other cryptocurrencies, according to an FBI statement released on Wednesday.

The stolen funds were rapidly transferred to thousands of wallet addresses across multiple blockchains. The FBI suspects these assets will eventually be laundered and converted into fiat currency.

While the North Korean government has not acknowledged the theft, reports from South Korea’s intelligence agencies suggest that North Korea has stolen $1.2 billion in cryptocurrency over the past five years.

The Washington Post reporting this noted:

It represents a rare source of badly needed foreign currency to support its fragile economy and fund its nuclear program in the face of intense U.N. sanctions and North Korea’s strict border closures during the coronavirus pandemic. A UN experts panel separately said it was investigating 58 suspected cyberattacks by North Korea between 2017 to 2023 that saw some $3 billion stolen to “reportedly help to fund the country’s development of weapons of mass destruction.”

Bybit’s Response and Industry Implications

Bybit’s co-founder and CEO, Ben Zhou, addressed the FBI’s accusations by linking to a site offering bounties to track and freeze the stolen assets.

https://t.co/FTHW8gIsT9 https://t.co/SdxPifNHUG

— Ben Zhou (@benbybit) February 27, 2025

The exchange revealed that the attack involved a sophisticated exploit targeting their offline or “cold” wallets, which are generally considered more secure than online storage. According to blockchain analytics firm Certik, this breach ranks as the largest blockchain-related hack to date.

Bybit Incident Technical Analysis

A phishing attack bypassed multi-sig safeguards, tricking signers into approving a malicious contract upgrade. Hackers exploited:
Device compromise (via social engineering)
Blind signing (UI spoofing on Safe{Wallet} + Ledger)

Learn… pic.twitter.com/FwnTDbskcc

— CertiK (@CertiK) February 23, 2025

Blockchain analyst Manuel Villegas explained that the attackers used a “blind signing” exploit. This method involves a fake user interface mimicking the legitimate platform, tricking users into authorizing unauthorized transactions.

The repercussions of this breach have extended beyond Bybit’s ecosystem, triggering a decline in overall cryptocurrency prices. Bitcoin has so far faced significant plunge falling to as low as $82,000 levels on Wednesday.

Industry observers suggest that this incident will increase regulatory scrutiny on cryptocurrency exchanges and their security measures.

Featured image created with DALL-E, Chart from TradingView

The FBI’s initiative to counter crypto investment fraud has helped thousands of victims avoid losing millions of dollars since its launch, according to a Feb. 13 press release.

Dubbed Operation Level Up, the program proactively identifies individuals in the midst of being scammed and intervenes before they lose their money.

Since its launch, the initiative has saved more than 4,300 potential victims from collectively losing an estimated $285 million, according to the FBI’s Criminal Investigative Division.

James Barnacle, deputy assistant director of the division, said:

“It’s a growing problem, and it’s a big problem affecting many Americans.”

Identifying victims before losses

Crypto investment fraud, often referred to as “pig butchering,” involves scammers cultivating online relationships — romantic, professional, or platonic — before luring victims into fraudulent investment schemes.

These fraudsters use fabricated trading platforms that display inflated returns, leading victims to pour more money into the scam. When they attempt to withdraw their funds, they are denied access.

Under Operation Level Up, the FBI tracks these scams in real-time and directly contacts victims before they commit additional funds. One targeted investor, planning to invest another $1 million, was warned in time by the FBI, while another was about to sell her home for a $500,000 investment before receiving an intervention call.

Beyond financial losses, victims often face emotional devastation. Some require support services or suicide intervention, underscoring the psychological toll of these scams, according to the FBI.

The FBI is urging the public to be cautious of unsolicited investment opportunities, especially those involving crypto. Operation Level Up not only warns potential victims but also gathers intelligence to track and dismantle the criminal networks behind these frauds.

The FBI is collaborating with domestic and international partners to shut down illicit domains and accounts. Financial institutions and private companies receive alerts on fraudulent platforms to prevent further transactions.

Multi-billion dollar industry

The FBI’s Internet Crime Complaint Center (IC3) reported $3.9 billion in crypto investment fraud losses in 2023. Meanwhile, “pig butchering” alone accounted for $3.6 billion in losses globally in 2024.

Officials believe the true figure is even higher, as many victims do not report or underreport their losses. On average, 3,200 complaints related to crypto scams are filed with IC3 each month.

Scammers target victims through social media, professional networking sites, text messages, investment groups, and dating platforms, often convincing even tech-savvy individuals to invest. Many victims, aged 30 to 60, are drawn in by the promise of financial security and high returns.

For those who suspect they are victims of crypto fraud, the FBI advises contacting their bank immediately and filing a complaint with the relevant law enforcement agencies. It also encouraged individuals to discuss potential scams with friends and family to prevent further victimization.