Svoboda Cybersecurity Brief September 14, 2025
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce for Data Theft
The FBI issued a flash alert detailing UNC6040 and UNC6395, two cybercriminal groups compromising Salesforce instances via OAuth token theft (UNC6395) and vishing campaigns (UNC6040). UNC6040 uses modified Salesforce Data Loader and custom Python scripts for bulk data exfiltration, while UNC6395 exploits Salesloft Drift vulnerabilities. Extortion tactics include impersonating ShinyHunters and threats of data leaks.
Impact: Large-scale data theft, extortion, and reputational damage.
Mitigation: Rotate OAuth tokens, enforce MFA, monitor API usage, and audit third-party integrations.
Source: The Hacker News
China’s Great Firewall Source Code Leak Exposes Censorship Tools
A 500GB leak of China’s Great Firewall infrastructure revealed source code, DPI modules, VPN detection tools, and operational logs from Geedge Networks and the MESA lab. The data includes SSL fingerprinting and session logging systems, exposing censorship mechanisms sold to three countries.
Impact: Potential exploitation of censorship tools, weakened state surveillance, and geopolitical ramifications.
Mitigation: Revoke exposed credentials, monitor for misuse of leaked code, and update detection mechanisms.
Source: DataBreaches.net
Ransomware Negotiation Leaks: Risks and Reputation Damage
Cybersecurity expert Valéry Rieß-Marchive highlights risks of leaked ransomware negotiations, including public exposure of attacks and compromised communication strategies. Leaks can trigger secondary attacks and erode trust, as seen in Balenciaga’s recent chat log exposure.
Source: DataBreaches.net
BreachForums Founder Faces Resentencing Amid Mental Health Debate
Conor Fitzpatrick (Pompompurin), founder of BreachForums, faces resentencing after appeals court rejected his initial time-served penalty. Prosecutors seek 188 months for access device fraud and child pornography, citing a victim CEO’s suicide, while defense argues prison would worsen his autism and suicide risk.
Source: DataBreaches.net
Share this brief: https://svo.bz/FoUL
If you want to support us, you can donate here: Donate