UNC6040 specializes in vishing campaigns targeting Salesforce for data theft.
The group uses social engineering tactics to impersonate IT support.
Attackers deploy a modified Salesforce Data Loader for unauthorized access.
The threats allow lateral movement within victims' networks to gather more data.