UNC6040 is a financially motivated threat cluster first documented in October 2024, specializing in voice phishing (vishing) campaigns. This group distinguishes itself by primarily targeting organizations' Salesforce instances for large-scale data theft and subsequent extortion, relying on manipulating human behavior rather than exploiting software vulnerabilities. UNC6040 often operates in conjunction with or under the brand of ShinyHunters, with an associated group, UNC6240, frequently handling the extortion phase.