---
id: 3865
title: "State of the SaaS Security Union"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/state-of-the-saas-security-union"
published_at: "2025-09-16 00:00"
tags: ["cloud", "threat-intelligence", "salesloft", "salesforce", "saas-security", "unc6040", "unc6395"]
phying_url: "https://phying.com/item/3865"
lang: en
---

# State of the SaaS Security Union

## Summary

AppOmni CTO Brian Soby on two active SaaS threats: UNC6040 ransoms stolen Salesforce data; UNC6395 breached Salesloft Drift and hit 700+ customers, harvesting secrets for Workspace, M365, and AWS.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2025-09-16 00:00
- **Original:** https://bishopfox.com/blog/state-of-the-saas-security-union
- **Phying News:** https://phying.com/item/3865