UNC6692 hackers exploit Microsoft Teams with fake IT alerts to deploy SNOW malware, steal credentials, and breach corporate networks in advanced attacks.

UNC6692 hackers exploit Microsoft Teams with fake IT alerts to deploy SNOW malware, steal credentials, and breach corporate networks in advanced attacks.

A threat group tracked as UNC6692 uses social engineering to deploy a new "Snow" malware set that includes a browser extension, a tunneler, and a backdoor.

UNC6692 relies on email bombing and social engineering to infect victims with Snow malware: Snowbelt, Snowglaze, and Snowbasin.

A newly identified threat group, UNC6692, has been caught running a sophisticated multistage intrusion campaign that uses Microsoft Teams impersonation , a custom modular malware suite, and cloud infrastructure abuse to deeply penetrate enterprise networks, all without exploiting a single software vulnerability. Google Threat Intelligence Group (GTIG) and Mandiant researchers disclosed the campaign on April 22, 2026, revealing how UNC6692 systematically manipulates employee trust in everyday enterprise tools to gain full domain-level access. In late December 2025, UNC6692 launched a mass email bombing campaign against its targets, deliberately flooding inboxes to create a sense of urgency and confusion. With victims overwhelmed and distracted, the threat actor delivered the critical blow by sending a phishing message directly over Microsoft Teams, with the attacker posing as an IT helpdesk employee offering assistance with the email volume. This technique is not a zero-day exploit or a software flaw. As Microsoft noted in its own April 2026 advisory, the campaign abuses legitimate external collaboration features in Teams, with attackers convincing users to override multiple, clearly presented security warnings. Victims accepted the Teams chat invitation from an account outside their organization, a seemingly minor action with catastrophic consequences. Infection Chain: From Teams Chat to Full Compromise Once in contact, the attacker directed the victim to click a link to install a “local patch” that purportedly prevents email spamming. The link led to a convincing phishing landing page masquerading as a “Mailbox Repair and Sync Utility v2.1.5”, hosted on an attacker-controlled AWS S3 bucket, Google said . The page enforced a multi-phase attack pipeline: Phase 1 – Environment Gating: A gatekeeper script checked the URL for a mandatory ?email= parameter and forced victims onto Microsoft Edge via the microsoft-edge: URI scheme, ensuring exploits would be most effective. Phase 2 – Credential Harvesting: A fake “Health Check” triggered an authentication prompt that rejected the first two password attempts by design — a psychological “double-entry” trick to ensure typo-free credential capture before exfiltrating them to an S3 bucket. Phase 3 – Distraction Sequence: A fake progress bar displayed messages like “Parsing configuration data” and “Checking mailbox integrity” to mask real-time data exfiltration in the background. Phase 4 – Malware Staging: While the progress bar ran, an AutoHotkey binary and script were downloaded from AWS S3 and automatically executed upon landing in the same directory — installing SNOWBELT, a malicious Chromium browser extension masquerading as “MS Heartbeat” or “System Heartbeat”. The SNOW Malware Ecosystem UNC6692’s toolset, dubbed the SNOW ecosystem, is a coordinated three-component modular framework: Component Type Role SNOWBELT JavaScript browser extension Initial foothold; intercepts and relays C2 commands; uses DGA-based S3 URLs for C2 SNOWGLAZE Python-based WebSocket tunneler Routes TCP traffic through the victim via a SOCKS proxy to a Heroku C2 server SNOWBASIN Python local HTTP server (port 8000) Executes shell commands, captures screenshots, exfiltrates files SNOWBELT maintained persistence through a Windows Startup folder shortcut, two scheduled tasks, and a headless Microsoft Edge process silently loading the extension. SNOWGLAZE masked malicious traffic by wrapping data in Base64-encoded JSON objects over WebSockets, making it appear as standard encrypted web traffic. After establishing initial access, UNC6692 executed a Python script via SNOWBASIN to scan the local network for open ports 135, 445, and 3389. Using PsExec sessions routed through the SNOWGLAZE tunnel, the attackers enumerated local administrator accounts and initiated an RDP session to a backup server. On the backup server, the threat actor used Windows Task Manager to dump the LSASS process memory, capturing password hashes, and exfiltrated the dump via LimeWire. With hashes in hand and safely off the network, the attacker performed offline credential extraction, then used Pass-the-Hash to authenticate directly to domain controllers without ever needing plaintext passwords. On the domain controller, the attacker downloaded FTK Imager, mounted the local drive, and extracted the Active Directory database (NTDS.dit), SAM, SYSTEM, and SECURITY registry hives, the crown jewels of any Windows enterprise environment. These were also exfiltrated via LimeWire. EDR telemetry captured the attacker taking targeted screenshots of active FTK Imager and Edge windows, confirming mission completion. A defining characteristic of the UNC6692 campaign is its systematic abuse of legitimate cloud services for every stage of the attack payload delivery, credential exfiltration, C2 infrastructure, and data staging, all of which relied on trusted platforms like AWS S3 and Heroku. This “living off the cloud” strategy allows malicious traffic to blend into high volumes of encrypted, reputably sourced web traffic, rendering domain reputation filters and IP-based blocklists largely ineffective. Defenders must expand visibility beyond traditional process monitoring to include browser extension activity, unauthorized cloud egress traffic, and headless browser processes. Critically, organizations should restrict or closely monitor Microsoft Teams external access settings to prevent unknown tenants from initiating chat sessions with employees. As UNC6692 demonstrates, the weakest link in enterprise security is not always a misconfigured server it is an employee who trusts a Teams message from someone claiming to be IT. Indicators of Compromise (IOCs) Phishing URL Pattern: https://service-page-[ID]-outlook.s3.us-west-2.amazonaws.com/update.html?email= C2 Server: wss://sad4w7h913-b4a57f9c36eb[.]herokuapp[.]com:443/ws SNOWBELT C2 URL Pattern: https://[a-f0-9]{24}-[0-9]{6,7}-[0-9]{1}.s3.us-east-2.amazonaws[.]com SNOWBELT VAPID Key: BJkWCT45mL0uvV3AssRaq9Gn7iE2N7Lx38ZmWDFCjwhz0zv0QSVhKuZBLTTgAijB12cgzMzqyiJZr5tokRzSJu0 Masquerading Files: RegSrvc.exe (AutoHotKey binary), Protected.ahk , SysEvents (SNOWBELT extension directory). Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Hackers Leverage Microsoft Teams to Breach Organizations Posing as IT Helpdesk Staff appeared first on Cyber Security News .

UNC6692 hackers exploit Microsoft Teams with fake IT alerts to deploy SNOW malware, steal credentials, and breach corporate networks in advanced attacks.

Google Threat Intelligence Group and Mandiant disclosed a multistage intrusion campaign by UNC6692 that combines persistent social engineering, abuse of AWS S3, and custom modular malware to steal credentials. The attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash. #UNC6692 #SNOWBELT

A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts. "As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account

Google a identifié un nouvel acteur malveillant, du nom de UNC6692, spécialisé dans des attaques d’ingénierie sociale ciblant les messageries professionnelles. Les hackers saturent les boîtes mail pui...

A newly identified threat group tracked as UNC6692 is hijacking Microsoft Teams to install a custom malware suite called SNOW. The campaign relies almost entirely on social engineering, which makes it dangerous because it feels routine to the people who fall for it. Attackers pose as IT helpdesk staff, exploiting a target’s trust in familiar collaboration tools to walk victims through handing over control of their machine. The attack begins with a wave of spam emails sent to a target’s inbox, creating chaos and urgency. Once the victim is overwhelmed, the same attacker reaches out through Microsoft Teams, posing as an IT support agent offering to fix the problem they caused. This staged setup convinces users to trust a stranger who appears to be solving an issue rather than creating one. Analysts at ExtraHOP said in a report shared with Cyber Security News (CSN) identified and detailed how this coordinated chain plays out from first contact to full network compromise. Once a victim accepts the fake Teams invitation, the attacker sends a link claiming to install a patch that stops the spam. Clicking it downloads a renamed AutoHotkey binary along with a script sharing the same file name, pulled from an attacker controlled cloud bucket. That download becomes the first stage of the SNOW malware ecosystem, a modular toolkit built to support activity after the breach. It includes a malicious browser extension, a Python based tunneling tool , and a lightweight local backdoor, each handling a part of the intrusion. Together they let the attacker maintain a presence long after the phishing message is forgotten. Once inside, UNC6692 does not rush. The group moves carefully through compromised systems, harvesting credentials, exploring internal networks, and expanding access before doing anything that might trigger alarms. UNC6692 Hackers Uses Microsoft Teams Helpdesk Impersonation The impersonation trick is simple but effective because it mirrors real corporate support interactions. After the spam flood, the attacker contacts the victim through a Teams chat request from an account outside the organization, posing as a helpful colleague. Many users accept external chat invitations without a second thought, especially when the message promises to fix a problem they already face. Victims are directed to a phishing page disguised as a mailbox repair and sync utility, complete with a professional interface and a health check button. That button triggers a login prompt, and the page asks for credentials multiple times under the guise of verification, which helps the stolen data hold up if checked later. The captured logins are then quietly sent to a cloud location controlled by the attacker. This is the entry point for everything that follows. Once the AutoHotkey script runs, it performs reconnaissance and installs SNOWBELT, a rogue browser extension, by launching Microsoft Edge in a hidden mode using command line settings that skip normal installation checks. Inside the SNOW Malware Toolkit SNOW is not a single piece of malware but a layered pipeline built for persistence and stealth. SNOWBELT operates within the browser and can survive restarts, while a Python based tunneling utility supports SOCKS5 style traffic to route commands through the compromised host, blending in with normal web activity. A separate local HTTP backdoor gives the attacker a direct channel for issuing commands and pulling data without relying on infrastructure that might get flagged. The toolkit also supports screenshot capture, file exfiltration, and session termination, giving operators control over how long they stay hidden. Because the traffic moves through legitimate cloud services and familiar Windows features, standard network monitoring often misses it entirely. Security teams should watch for unusual browser extension installations, scheduled tasks that launch Edge in headless mode, and unexpected outbound connections to unfamiliar endpoints. Organizations are advised to restrict external chat permissions on Microsoft Teams to approved contacts and train employees to treat unsolicited helpdesk outreach with caution. Blocking unapproved file sharing platforms and requiring verification before remote assistance can reduce exposure to this kind of intrusion. This campaign shows how attackers favor patience and disguise over brute force, turning ordinary workplace habits into an opening for deep compromise. Indicators of Compromise (IoCs):- Type Indicator Description File AutoHotkey binary (renamed, filename matches accompanying script) Delivered from attacker controlled AWS S3 bucket; initiates SNOWBELT installation  File AutoHotkey script (same filename as binary) Executes automatically upon download, bypasses standard user prompts to deploy SNOWBELT  File 7ZIP Imager tool Used by threat actor to compress and exfiltrate the entire Active Directory database (NTDS.dit)  Tool SNOWBELT Malicious Chromium browser extension component of the SNOW malware ecosystem, installed via headless Microsoft Edge  Tool SNOWGLAZE Python based tunneling utility supporting SOCKS5 traffic to conceal command and control communications  Tool SNOWBASIN Local HTTP backdoor providing a direct command channel on the compromised host  Infrastructure Amazon Web Services S3 bucket Attacker controlled storage used to host and serve the initial malicious AutoHotkey payload  Infrastructure Cloud storage exfiltration endpoint Destination used by SNOWGLAZE to move harvested NTDS.dit data and credentials off the victim network  Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Prevent critical incidents and financial loss with stronger proactive defense.  Integrate a live threat feed from 15K SOC Teams . The post UNC6692 Hackers Uses Microsoft Teams Helpdesk Impersonation to Deploy SNOW Malware appeared first on Cyber Security News .

Google Threat Intelligence Group attributes a multistage intrusion to UNC6692 that used persistent social engineering via Microsoft Teams, a malicious phishing landing page, and staged downloads to deliver a modular SNOW malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) that enabled internal reconnaissance, credential theft, lateral movement, and exfiltration. The campaign abused trusted cloud services (AWS S3, CloudFront, Heroku) for C2 and payload hosting and relied on a malicious Chromium extension and AutoHotKey-based persistence to maintain long-term access. #UNC6692 #SNOWBELT

A newly identified threat group, UNC6692, has been caught running a sophisticated cyberattack campaign that uses Microsoft Teams impersonation, fake IT

A newly identified threat actor, tracked as UNC6692, is conducting a multipronged campaign combining social engineering, malware deployment, and cloud abuse. The group leverages Microsoft Teams for initial access, abuses AWS S3 buckets for malicious operations, and employs a custom malware strain dubbed "Snow." No specific dates, victim details, or CVE identifiers were disclosed in the report. The campaign’s technical impact includes unauthorized access to cloud environments and potential data exfiltration or lateral movement. The attack chain integrates phishing via Teams, cloud infrastructure exploitation, and bespoke malware to achieve its objectives.

UNC6692 uses social engineering via email spamming and Microsoft Teams phishing to deploy a modular malware suite.

Die Bedrohungsgruppe UNC6692 nutzt die Vortäuschung von IT-Mitarbeitern über Microsoft Teams sowie massenhafte E-Mail-Bombardements, um das SNOW-Malware-Toolkit zu verbreiten und Zugangsdaten aus Unternehmensnetzwerken zu stehlen.

Google-Forscher warnen vor einer Hackergruppe, die Nutzer bei Microsoft Teams austrickst, um gefährliche Malware in Firmennetzwerke zu schleusen.

A threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named 'Snow' which includes a browser extension, a tunneler, and a backdoor.

A threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named 'Snow' which includes a browser extension, a tunneler, and a backdoor.