UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

UNC6692 is a threat actor using social engineering via Microsoft Teams to deploy the SNOW malware suite on corporate networks.

• •Email bombing campaigns combined with Teams help desk impersonation provide initial access
• •Victims click phishing links downloading AutoHotkey scripts from AWS S3 buckets
• •SNOW malware ecosystem includes SNOWBELT (JavaScript backdoor), SNOWGLAZE (Python tunneler), and SNOWBASIN (persistent backdoor)
• •Attack chain involves credential harvesting, lateral movement via Pass-The-Hash, and data exfiltration
• •Attackers abuse cloud services to bypass reputation filters and blend into legitimate traffic

This summary was automatically generated by AI based on the original article and may not be fully accurate.