UNC6345

UNC6345 is a threat cluster tracked for targeting Salesforce customer environments through abuse of compromised OAuth tokens tied to the Salesloft Drift third-party integration. The activity is associated with large-scale data theft from numerous corporate Salesforce instances, with attackers using stolen machine-to-machine OAuth access to systematically export sensitive data and support subsequent extortion demands. The cluster is part of a broader 2025 wave of attacks against Salesforce ecosystems in which customer instances, rather than Salesforce’s core platform, were accessed through identity and application-layer compromise. UNC6345 is specifically linked to the compromise and misuse of OAuth tokens associated with Drift, enabling unauthorized access to connected Salesforce environments without relying on exploitation of a Salesforce software vulnerability. The actor’s observed tradecraft centers on token theft, abuse of trusted third-party integrations, and bulk data exfiltration from victim SaaS environments. Public reporting places this activity alongside related Salesforce-focused intrusion waves involving social engineering, phishing, vishing, and malicious connected-app authorization by other tracked clusters such as UNC6040, as well as broader overlap in reporting with criminal ecosystems including ShinyHunters, Scattered Spider, and The Com. High-confidence attribution for UNC6345 itself supports data theft and extortion-linked operations against enterprise victims.