Google’s Threat Intelligence Group is tracking a financially motivated threat cluster, UNC6040, which employs voice phishing to compromise Salesforce environments and exfiltrate data. Following these intrusions, they engage in extortion tactics, often posing as the group ShinyHunters and pressuring victims for payment in bitcoin. The growing sophistication of these tactics highlights the vulnerabilities in organizational defenses, particularly targeting IT personnel for initial access.