20260423-thehackernews.com-e7809 | Perceptive Security

< Back to index

UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

Published:

23 April 2026 at 18:16:00

Alert date:

23 April 2026 at 19:01:54

Source:

thehackernews.com

Ransomware & Malware, Email & Messaging, Enterprise Applications

UNC6692 threat actor conducts social engineering attacks by impersonating IT helpdesk employees via Microsoft Teams. The group convinces victims to accept chat invitations from fake accounts to deploy custom SNOW malware suite. This represents a novel use of enterprise collaboration platforms for initial access and malware deployment.

Technical details

UNC6692 uses social engineering via Microsoft Teams by first overwhelming victims with email spam campaigns, then contacting them as fake IT helpdesk to offer assistance. Victims are tricked into clicking phishing links that download AutoHotkey scripts from AWS S3 buckets. The attack deploys the SNOW malware suite including SNOWBELT (JavaScript-based backdoor browser extension for Edge), SNOWGLAZE (Python-based WebSocket tunneler), and SNOWBASIN (persistent backdoor with HTTP server on ports 8000-8002). The malware enables remote command execution, screenshot capture, file upload/download, network scanning for ports 135/445/3389, lateral movement via PsExec and RDP, LSASS memory extraction, Pass-The-Hash attacks, and data exfiltration using FTK Imager and LimeWire.

Mitigation steps:

Enforce help desk verification workflows, tighten external Teams and screen-sharing controls, harden PowerShell execution, treat collaboration tools as first-class attack surfaces, implement network reputation filters for cloud traffic monitoring, monitor for suspicious browser extension installations, watch for unusual HTTP server activity on ports 8000-8002, detect LSASS memory extraction attempts, monitor for Pass-The-Hash attack indicators, and implement controls for external Teams chat invitations.

Affected products:

Microsoft Teams
Microsoft Edge
Quick Assist
Supremo Remote Desktop
Windows Task Manager
FTK Imager
LimeWire
AWS S3

Related CVE's:

Related threat actors:

UNC6692

Black Basta affiliates

IOC's:

Mailbox Repair and Sync Utility v2.1.5, SNOWBELT browser extension, SNOWGLAZE tunneler, SNOWBASIN backdoor, HTTP servers on ports 8000, 8001, 8002, Network scans on ports 135, 445, 3389, AutoHotkey scripts from AWS S3 buckets, PhantomBackdoor trojan, WebSocket-based communications

This article was created with the assistance of AI technology by Perceptive.