Mandiant Details UNC6692’s Snow Malware and Attack Chain
Summary
Mandiant says UNC6692 used email bombing and Microsoft Teams helpdesk impersonation to deliver the Snow malware suite, then used credential theft and lateral movement to reach domain controllers and exfiltrate Active Directory data.
Key points
- Mandiant reports that UNC6692 used email bombing and Microsoft Teams helpdesk impersonation to trick targets into installing a purported anti-spam patch.
- The dropper ran AutoHotkey scripts and installed SnowBelt, a malicious Chrome extension running on a headless Edge instance, with scheduled tasks and a startup shortcut for persistence.
- SnowGlaze created a WebSocket tunnel and SOCKS proxy; SnowBasin, a Python backdoor, could run commands, provide remote shell access, transfer files, capture screenshots, and manage files.
- Mandiant says the attackers scanned for SMB and RDP services, dumped LSASS memory, and used pass-the-hash to move laterally toward domain controllers.
- The attackers used FTK Imager to collect the Active Directory database and registry hives, then exfiltrated the files using LimeWire.
- Mandiant provided indicators of compromise and YARA rules to help detect the Snow toolset.
Article Details
- Attack Vectors
- UNC6692 reportedly uses email bombing followed by Microsoft Teams helpdesk impersonation to pressure targets into clicking a link and installing a malicious patch.
- The link delivers a dropper that runs AutoHotkey scripts and installs the SnowBelt Chrome extension on a headless Microsoft Edge instance.
- SnowGlaze establishes a WebSocket tunnel and SOCKS proxy to relay commands and route TCP traffic through compromised hosts.
- SnowBasin executes attacker-supplied CMD or PowerShell commands and supports remote shell access, file downloads, screenshots, file management, and data exfiltration.
- Post-compromise activity includes SMB and RDP service scanning, LSASS memory dumping, pass-the-hash lateral movement, and exfiltration of Active Directory data and registry hives using FTK Imager and LimeWire.
- Defensive Notes
- Mandiant published indicators of compromise and YARA rules to help detect the Snow toolset.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe attackers dump LSASS memory to obtain credential material.T1041 · Exfiltration Over C2 ChannelThe reported malware supports data exfiltration through the same command-and-control pipeline.T1046 · Network Service DiscoveryPost-compromise reconnaissance includes scanning for SMB and RDP services.T1053.005 · Scheduled TaskScheduled tasks are created for persistence.T1059.001 · PowerShellSnowBasin executes attacker-supplied PowerShell commands on infected systems.T1059.003 · Windows Command ShellSnowBasin executes attacker-supplied CMD commands on infected systems.T1059.010 · AutoHotKey & AutoITThe dropper runs AutoHotkey scripts to load SnowBelt.T1090 · ProxySnowGlaze provides SOCKS proxy operations that route arbitrary TCP traffic through infected hosts.T1176 · Software ExtensionsSnowBelt is installed as a malicious Chrome extension and runs on a headless Microsoft Edge instance.T1204.001 · Malicious LinkTargets are prompted to click a link presented as a patch that would block email spam.T1547.001 · Registry Run Keys / Startup FolderA shortcut in the startup folder is created for persistence.T1550.002 · Pass the HashThe attackers use pass-the-hash to authenticate to additional hosts.T1566.003 · Spearphishing via ServiceThe reported operators contact targets through Microsoft Teams while impersonating IT helpdesk agents.T1572 · Protocol TunnelingSnowGlaze creates a WebSocket tunnel to carry communications between infected hosts and C2 infrastructure.T1656 · ImpersonationThe reported operators pose as IT helpdesk agents to persuade targets to install the malicious patch.
Threat Actors
Malware
Snowsocial engineering and Microsoft Teams helpdesk impersonation to deploy a custom malware suite called “Snow,” which combines a Chrome extension, a tunneler, and a Python backdoor to establish covert persistence andSnowbasinSnowBasin runs a local HTTP server, executes attacker-supplied commands, supports remote shell and data exfiltration, and can capture screenshots and manage files.SNOWBELTThe Snow toolset is deployed via a dropper that runs AutoHotkey scripts and installs the SnowBelt Chrome extension on a headless Edge instance.SnowglazeSnowGlaze creates a WebSocket tunnel and SOCKS proxy to mask C2 communications and route arbitrary TCP traffic through infected hosts.
Products
Google ChromeMicrosoft Teams helpdesk impersonation to deploy a custom malware suite called “Snow,” which combines a Chrome extension, a tunneler, and a Python backdoor to establish covert persistence and relay commands.Microsoft EdgeThe extension executes on a headless Microsoft Edge instance, so the victim doesn’t notice anything, while scheduled tasks and a startup folder shortcut are also created for persistence.Microsoft TeamsUNC6692 uses social engineering and Microsoft Teams helpdesk impersonation to deploy a custom malware suite called “Snow,” which combines a Chrome extension, a tunneler, and a Python backdoor to establish covert
Tools
AutoHotkeyThe Snow toolset is deployed via a dropper that runs AutoHotkey scripts and installs the SnowBelt Chrome extension on a headless Edge instance.FTK ImagerThe group conducts deep network compromise—dumping LSASS, using pass-the-hash, and exfiltrating Active Directory data (via FTK Imager and LimeWire) to steal credentials and take over domains.LimeWireThe group conducts deep network compromise—dumping LSASS, using pass-the-hash, and exfiltrating Active Directory data (via FTK Imager and LimeWire) to steal credentials and take over domains.YARAPost-compromise activity includes SMB/RDP scanning, LSASS memory dumps, pass-the-hash lateral movement, and exfiltration of AD data—Mandiant published IoCs and YARA rules to detect Snow.