Google Publishes Security Hardening Guide to Counter UNC6040 Threats
Google's Threat Intelligence Group has released a guide aimed at enhancing the security of SaaS platforms, particularly Salesforce, against sophisticated voice-phishing and malicious connected-app attacks by UNC6040.
Google's Threat Intelligence Group has released a guide aimed at enhancing the security of SaaS platforms, particularly Salesforce, against sophisticated voice-phishing and malicious connected-app attacks by UNC6040.
The guide highlights the importance of combining identity hardening, SaaS-specific controls, and advanced logging and detection to mitigate risks related to credential compromise and data exfiltration.
1. Identity Verification and Protections
Implement positive identity proofing to prevent social engineering. This includes live video calls with ID verification and cross-referencing employee records. High-risk requests should require out-of-band verification.
Adopt phishing-resistant multi-factor authentication (MFA) and enforce Single Sign-On (SSO) through corporate identity providers. Access should be restricted based on device posture.
For Salesforce instances, strengthen network and API access controls:
This includes live video calls with ID verification and cross-referencing employee records.
Enforce login IP ranges at the profile level to block unauthorized access. Adopt a "deny by default" approach for connected apps; maintain a vetted allowlist. Limit "API Enabled" permissions and prefer SSO over native accounts. Implement least-privilege profiles and restrict Setup menu access. Use row-level restrictions and private organization-wide defaults to limit data exposure.
To detect UNC6040's activities, integrate Salesforce Shield and Event Monitoring logs into your SIEM. Key log sources include Login History, Setup Audit Trail, Bulk API results, and API event streams. Enable real-time streaming for alerting and schedule regular batch exports for analysis.
Flag suspicious connected-app authorizations followed by significant data downloads. Correlate OAuth successes with subsequent logins from risky IPs. Identify bursts of API calls and large report exports by non-integration accounts.
Maintain reference lists to minimize noise and adjust rules during data migrations or vendor onboarding.
The guide provides actionable steps to enhance security across identity, application hardening, and continuous monitoring, helping organizations defend against vishing and data-theft techniques.
Based on reporting by GBHackers.