cyber.hendryadrian.com
Threat Research · darkreading.com

UNC6692 Uses Teams Social Engineering and Custom Malware to Steal Credentials

· Original article ↗

Summary

GTIG and Mandiant say UNC6692 used email flooding and Teams help-desk impersonation to deliver malware via AWS S3, steal credentials from LSASS, and move laterally with pass-the-hash. They published IOCs and YARA rules.

Key points

  • GTIG and Mandiant describe UNC6692 as a newly tracked threat actor; they suspect it is financially motivated but did not attribute it to an established identity or location.
  • The actor reportedly flooded a target's inbox, then impersonated help-desk staff through Microsoft Teams to persuade the target to install a purported patch.
  • A link led to an HTML page that downloaded a renamed AutoHotkey binary and script from an actor-controlled AWS S3 bucket.
  • The attackers installed SNOWBELT, a malicious Chromium extension, and used it to deploy Snowglaze, a Python tunneler, and Snowbasin, a Python bindshell.
  • The reported activity included scanning local-network ports, using RDP to access a backup server, and extracting LSASS process memory to obtain credentials.
  • UNC6692 reportedly used pass-the-hash to move laterally to a domain controller; the article says it was preparing to stage and extract data, not that data theft was confirmed.
  • Google published IOCs and YARA rules and advised defenders to monitor browser activity and unauthorized cloud traffic.

Article Details

Attack Vectors
  • UNC6692 flooded a target's inbox with email, then contacted them through Microsoft Teams while posing as help desk personnel.
  • The attackers sent a phishing link that led the target to an HTML page and a supposed patch; the page downloaded a renamed AutoHotkey binary and script from an attacker-controlled AWS S3 bucket.
  • A malicious Chromium extension named SNOWBELT delivered Snowglaze, Snowbasin, AutoHotkey scripts, and a portable Python runtime.
  • A Python script scanned the local network for ports 135, 445, and 3389 and enumerated local administrator accounts.
  • The attackers used a local administrator account to establish an RDP session through Snowglaze to a backup server.
  • The attackers extracted LSASS process memory using LimeWire and then used pass-the-hash to move laterally to the domain controller.
Defensive Notes
  • Monitor browser activity and investigate unauthorized Chromium extensions.
  • Monitor unauthorized cloud traffic and cloud egress, including abuse of AWS S3 for payload delivery, exfiltration, and C2.
  • Correlate activity across browsers, local Python environments, and cloud egress points for early detection.
  • AWS said suspected abuse of its services can be reported to AWS Trust & Safety.

MITRE ATT&CK

T1003.001 · LSASS MemoryThe attackers extracted LSASS process memory from the backup server to obtain credentials.T1021.001 · Remote Desktop ProtocolThe attackers used RDP through Snowglaze to connect from the victim system to a backup server.T1046 · Network Service DiscoveryThe Python script scanned the local network for ports 135, 445, and 3389.T1059.006 · PythonThe attackers used a Python script to scan the local network and enumerate local administrator accounts.T1059.010 · AutoHotKey & AutoITThe attackers used an AutoHotkey binary and script as a stager.T1087.001 · Local AccountThe attackers enumerated local administrator accounts.T1102.002 · Bidirectional CommunicationGoogle described the AWS S3 bucket as part of the campaign's command-and-control infrastructure.T1105 · Ingress Tool TransferThe HTML page downloaded an AutoHotkey binary and script from an attacker-controlled AWS S3 bucket; SNOWBELT also downloaded additional components.T1176 · Software ExtensionsThe attackers installed SNOWBELT, a malicious Chromium browser extension not distributed through the Chrome Web Store.T1204.001 · Malicious LinkThe target clicked the phishing link and opened the resulting HTML page.T1550.002 · Pass the HashThe attackers used pass-the-hash to move laterally to the domain controller.T1566.003 · Spearphishing via ServiceUNC6692 sent a phishing link through Microsoft Teams while posing as help desk personnel.T1567.002 · Exfiltration to Cloud StorageGoogle described the campaign's abuse of an AWS S3 bucket for exfiltration.

Threat Actors

UNC6692Google Threat Intelligence Group and Mandiant tracked UNC6692 as responsible for the described intrusion campaign. Researchers suspected the group's operations were financially motivated; they did not attribute it to a previously established identity or location.

Malware

SnowbasinThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.SNOWBELTThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.SnowglazeThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.

Vendors

Amazon Web ServicesGoogle Threat Intelligence Group and Mandiant disclosed a multistage intrusion campaign by UNC6692 that combines persistent social engineering, abuse of AWS S3, and custom modular malware to steal credentials.MicrosoftUNC6692 uses coordinated email flooding and Microsoft Teams social engineering to trick targets into installing a malicious “patch.”

Products

AWS S3Google Threat Intelligence Group and Mandiant disclosed a multistage intrusion campaign by UNC6692 that combines persistent social engineering, abuse of AWS S3, and custom modular malware to steal credentials.ChromiumThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.Microsoft TeamsUNC6692 uses coordinated email flooding and Microsoft Teams social engineering to trick targets into installing a malicious “patch.”Microsoft WindowsNow with access to the backup server, the threat actor further uses the local admin account to extract the system’s LSASS Microsoft Windows Local Security Authority Subsystem Service (LSASS) process memory.

Tools

AutoHotkeyThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.LimeWireThe attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash.

Related Articles