Mandiant Details UNC6692 Campaign Impersonating Microsoft Teams Support
Summary
Mandiant says UNC6692 impersonates Microsoft Teams support after flooding targets with email, steering employees to a fake repair utility that installs the SnowBelt backdoor and can deliver additional tools.
Key points
- Mandiant attributes the campaign to the newly tracked cluster UNC6692.
- Attackers reportedly flood targeted inboxes, then contact employees through Teams while posing as support from outside their organization.
- A fake “Mailbox Repair Utility” prompts victims to download a script that installs the SnowBelt browser extension.
- Mandiant describes SnowBelt as a backdoor that can maintain access to corporate accounts and move through internal systems.
- SnowBelt can download SnowGlaze, SnowBasin, AutoHotkey scripts and a portable Python environment.
- The phishing page pushes users to Microsoft Edge, and its credential-harvesting script reportedly rejects the first two password submissions.
Article Details
- Event Type
- Phishing and social-engineering campaign using email flooding, Microsoft Teams impersonation, and a malicious browser extension to gain access to corporate networks.
- Impact
- According to Mandiant, the campaign attributed to UNC6692 can steal credentials, maintain access to corporate accounts, and facilitate movement through internal systems. The SnowBelt extension can also download SnowGlaze, SnowBasin, and additional malicious code.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe credential-harvesting page captures passwords and deliberately rejects the first two submissions to prompt victims to enter them again.T1566.002 · Spearphishing LinkAttackers send phishing messages through Microsoft Teams and direct victims to a page used to deliver the malicious extension.
Threat Actors
Malware
SnowbasinThe operation, attributed to UNC6692, uses email flooding, Teams phishing and a fake “Mailbox Repair Utility” to deploy the SnowBelt extension and secondary tools like SnowGlaze and SnowBasin.SNOWBELTThe operation, attributed to UNC6692, uses email flooding, Teams phishing and a fake “Mailbox Repair Utility” to deploy the SnowBelt extension and secondary tools like SnowGlaze and SnowBasin.SnowglazeThe operation, attributed to UNC6692, uses email flooding, Teams phishing and a fake “Mailbox Repair Utility” to deploy the SnowBelt extension and secondary tools like SnowGlaze and SnowBasin.
Products
Microsoft EdgeVictims are steered to a fake “Mailbox Repair Utility” page that encourages switching to Microsoft Edge and downloading a script.Microsoft TeamsMandiant reports a campaign in which attackers impersonate Microsoft Teams help desk staff to trick employees into installing a malicious browser extension.