Threat Research · securityweek.com

UNC6692 Uses Email Bombing and Fake IT Support to Deploy Snow Malware

Apr 27, 2026 · Original article ↗

Summary

Google Threat Intelligence Group reports that UNC6692 used email bombing and fake IT support to deploy Snow malware, move through a victim’s network, harvest credentials, and collect data from a domain controller.

Key points

GTIG says UNC6692 overwhelmed a victim with email, then impersonated IT support on Microsoft Teams to direct them to a fake mailbox repair page.
The phishing page harvested credentials and downloaded AutoHotkey components that installed Snowbelt, a JavaScript backdoor deployed as a Chromium extension.
Snowbelt’s persistence included a Windows startup shortcut and scheduled tasks that launched and managed headless Edge processes.
The attackers used Snowglaze, a Python-based tunnel, for network access and lateral movement; Snowbasin provided backdoor functions including command execution and data harvesting.
GTIG reports that UNC6692 accessed a backup server, dumped LSASS memory, and used Pass-the-Hash to reach a domain controller.
The actor reportedly used FTK Imager and LimeWire to collect and exfiltrate credential and directory data.

Article Details

Attack Vectors: UNC6692 overwhelmed a victim with emails, then contacted them through Microsoft Teams while impersonating IT helpdesk staff.
The attackers directed the victim to a phishing page offering a fake mailbox repair utility and used a fake authentication prompt to harvest credentials.
A script on the page downloaded an AutoHotKey binary and script; their execution led to deployment of the Snowbelt browser-extension backdoor.
The attackers used Snowbelt to download additional payloads, including Snowglaze and Snowbasin, from an attacker-controlled AWS S3 bucket.
UNC6692 used Snowglaze with PsExec for reconnaissance, then accessed a backup server over RDP and later used Pass-The-Hash to access a domain controller.
The attackers dumped LSASS memory and used LimeWire to exfiltrate data; they also used FTK Imager to collect the Active Directory database and registry hives for exfiltration.
Defensive Notes: The article notes that malicious components hosted on trusted cloud platforms can blend into legitimate traffic and bypass traditional network reputation filters.

MITRE ATT&CK

T1003.001 · LSASS MemoryThe attackers dumped LSASS process memory from the backup server.T1005 · Data from Local SystemThe attackers collected the Active Directory database and the SAM, System, and Security registry hives from the domain controller.T1021.001 · Remote Desktop ProtocolThe attackers initiated an RDP session to a backup server through the Snowglaze tunnel.T1053.005 · Scheduled TaskThe attackers created two scheduled tasks to launch a windowless Edge process and to kill headless Edge processes.T1056.003 · Web Portal CaptureThe fake authentication box on the mailbox-repair page was designed to harvest and validate the victim's credentials.T1059.007 · JavaScriptThe page ran a script that downloaded payloads, and Snowbelt is described as a JavaScript-based backdoor.T1071.001 · Web ProtocolsSnowglaze used a WebSocket tunnel to communicate with the attackers' command-and-control server.T1087.001 · Local AccountThe attackers used the PsExec session to enumerate administrator accounts on the system.T1090 · ProxySnowglaze supported SOCKS proxy operations and was used to tunnel access to the backup server.T1105 · Ingress Tool TransferThe page downloaded an AutoHotKey binary and script, and Snowbelt later downloaded additional payloads from an attacker-controlled AWS S3 bucket.T1547.009 · Shortcut ModificationThe code added a shortcut to an AutoHotKey script to the Windows startup location for persistence.T1550.002 · Pass the HashUNC6692 used Pass-The-Hash to access the network's domain controller.T1566.003 · Spearphishing via ServiceUNC6692 used Microsoft Teams to impersonate IT helpdesk staff and direct the victim to a phishing page.T1569.002 · Service ExecutionUNC6692 used Sysinternals PsExec to establish a session to the system.T1572 · Protocol TunnelingSnowglaze created an authenticated WebSocket tunnel to the attackers' command-and-control server.

Threat Actors

UNC6692GTIG reports that UNC6692 conducted the described December 2025 campaign, using email bombing and IT-support impersonation to deploy Snow malware and access victim systems.

Malware

SnowbasinNext, the attackers used the malicious extension to download additional payloads, including AutoHotkey scripts, a ZIP archive, the Snowglaze tunnel, and the Snowbasin malware, from an attacker-controlled AWS S3 bucket.SNOWBELTto the system. Upon execution, the payloads infected the system with a JavaScript-based backdoor dubbed Snowbelt, which was deployed as a Chromium browser extension.SnowglazeNext, the attackers used the malicious extension to download additional payloads, including AutoHotkey scripts, a ZIP archive, the Snowglaze tunnel, and the Snowbasin malware, from an attacker-controlled AWS S3 bucket.

Products

Microsoft Active Directorydownloaded FTK Imager to it, used the tool to mount the local storage drive and write the Active Directory database file, Security Account Manager (SAM), System, and Security registry hives to the \Downloads Microsoft EdgeThe page checked for an email parameter in the link, checked that the victim’s browser was Microsoft Edge, and presented a panel posing as the repair utility.Microsoft TeamsIn December 2025, the threat actor, tracked as UNC6692, was seen overwhelming the target with email messages and then contacting the victim via Microsoft Teams, posing as an IT helpdesk employee.Microsoft WindowsTo establish persistence for the extension, the code added a shortcut to an AutoHotKey script to the Windows startup and created two scheduled tasks to open a windowless Edge process and load Snowbelt, and to kill

Tools

AutoHotkeyIn the background, a script on the page downloaded an AutoHotKey binary and an AutoHotKey script to the system. Upon execution, the payloads infected the system with a JavaScript-based backdoor dubbed Snowbelt, which FTK ImagerNext, UNC6692 used Pass-The-Hash to access the network’s domain controller, downloaded FTK Imager to it, used the tool to mount the local storage drive and write the Active Directory database file, Security Account LimeWireThe threat actor then dumped the LSASS process memory from the backup server and exfiltrated it via LimeWire to extract usernames, passwords, and user account hashes from it.PsExecUNC6692 used Snowglaze to establish a Sysinternals PsExec session to the system and enumerate administrator accounts.

Related Articles