Sign in Subscribe

UNC6240

UNC6661, UNC6671, and UNC6240 are separate SSO-credential-theft crews tracked by Google/Mandiant in January 2026, using a shared playbook but assessed as distinct operator sets. UNC6240 has been linked to ShinyHunters-branded extortion messaging.

Trending Topics

Trending Topics

ShinyHunters and Scattered Spider intrusions show identity is now the top SaaS attack vector. State-backed actors compromised Notepad++'s update servers. ShadowHS delivers fileless Linux post-exploitation. Arsink Android RAT impersonates 50+ consumer brands.