UNC6395
UNC6395 is a threat actor tracked by Google Threat Intelligence Group/Mandiant and also referred to in the provided content as GRUB1. The actor was attributed to a widespread 2025 data-theft campaign targeting Salesforce customer instances by abusing compromised OAuth and refresh tokens associated with the Salesloft Drift integration. Activity was reported from at least August 8 through August 18, 2025, and the campaign affected hundreds of organizations, with reporting citing more than 700 potentially impacted organizations. According to the provided content, UNC6395 systematically queried and exported large volumes of data from connected Salesforce environments, including objects such as Cases, Accounts, Contacts, Opportunities, and Users. The actor used legitimate stolen OAuth tokens to impersonate the trusted Drift application, bypassing normal authentication controls, and in some reporting also accessed connected Google Workspace environments and, in some cases, Slack integrations. The content states the actor’s primary objective was credential harvesting: after exfiltration, UNC6395 searched stolen data for AWS access keys, passwords, Snowflake-related tokens, cloud credentials, API keys, and other secrets embedded in support cases or CRM records. The content also states that UNC6395 demonstrated operational security awareness by deleting query jobs to conceal activity, while logs remained available for investigation. Investigators cited use of DigitalOcean and AWS infrastructure to support or obfuscate operations. Separate reporting in the content says Google-owned Mandiant observed UNC6395 accessing Salesloft’s GitHub account from March through June 2025, downloading repository content, adding a guest user, and setting up workflows over a months-long period preceding the August campaign. Victim organizations named in the provided content include Cloudflare, Zscaler, Palo Alto Networks, Workday, Workiva, Proofpoint, Qualys, Tenable, HackerOne, BeyondTrust, Bugcrowd, Cato Networks, CyberArk, Elastic, Fastly, JFrog, Nutanix, PagerDuty, Rubrik, and others. The content explicitly notes that the issue did not stem from a vulnerability in the core Salesforce platform, but from compromise of the third-party Drift integration and its OAuth trust relationship.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stole data from companies' Salesforce instances by abusing OAuth tokens tied to the third-party sales automation app Salesloft Drift.
Stole OAuth tokens from third-party Salesforce integrations and used them to query hundreds of Salesforce instances, exfiltrating massive volumes of records and secrets embedded in support cases.
Referenced in connection with Salesforce-targeting breach activity, but no distinct operational details are provided in the content.
Conducted a supply-chain intrusion via the Salesloft Drift integration, using stolen OAuth tokens to access and export Salesforce data from hundreds of organizations, including Workday, and searching exfiltrated CRM data for embedded credentials and secrets.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.