cyber.hendryadrian.com
Threat Research · thehackernews.com

UNC6692 Uses Teams Help Desk Impersonation to Deploy SNOW Malware

· Original article ↗

Summary

Mandiant reports that UNC6692 uses email bombing and Microsoft Teams help-desk impersonation to deliver a modular SNOW toolkit, steal credentials, move laterally, and collect and exfiltrate data.

Key points

  • UNC6692 floods targets with email, then impersonates IT support on Microsoft Teams to persuade them to install a purported mailbox repair utility.
  • The phishing page downloads an AutoHotkey script from an actor-controlled AWS S3 bucket; the script installs the SNOWBELT browser extension on Microsoft Edge.
  • SNOWBELT relays commands to SNOWBASIN, while SNOWGLAZE creates a WebSocket tunnel between the victim's network and attacker infrastructure.
  • SNOWBASIN provides persistence, remote command execution, screenshot capture, and file transfer; the phishing page also prompts victims to enter mailbox credentials for exfiltration.
  • Reported post-compromise activity includes network scanning, PsExec and RDP through the tunnel, LSASS memory extraction, Pass-the-Hash lateral movement, and data collection with FTK Imager followed by exfiltration using LimeWire.
  • Mandiant says the operators abuse legitimate cloud services for payload delivery, command-and-control, and exfiltration, which can help malicious traffic blend with legitimate cloud activity.

Article Details

Attack Vectors
  • UNC6692 overwhelms targets with spam emails, then impersonates IT helpdesk staff through Microsoft Teams to offer assistance.
  • Victims are directed through a Teams chat link to a phishing page named “Mailbox Repair and Sync Utility v2.1.5,” which downloads an AutoHotkey script from an attacker-controlled AWS S3 bucket.
  • The script installs the SNOWBELT browser extension in Microsoft Edge and deploys SNOWGLAZE and SNOWBASIN. The attackers also use a configuration panel to capture mailbox credentials.
  • Post-compromise activity includes scanning for network services, using PsExec and RDP through the SNOWGLAZE tunnel, extracting LSASS memory, using Pass-the-Hash for lateral movement, and exfiltrating data.
  • A separate campaign described by Cato Networks uses voice phishing and helpdesk impersonation in Microsoft Teams to induce victims to run an obfuscated PowerShell script that deploys PhantomBackdoor.
Defensive Notes
  • Enforce helpdesk verification workflows.
  • Tighten controls for external Microsoft Teams interactions and screen sharing.
  • Harden PowerShell.
  • Treat collaboration tools as attack surfaces.

MITRE ATT&CK

T1003.001 · LSASS MemoryUNC6692 uses Windows Task Manager to extract LSASS process memory.T1021.001 · Remote Desktop ProtocolUNC6692 initiates an RDP session through the SNOWGLAZE tunnel from a victim system to a backup server.T1021.002 · SMB/Windows Admin SharesUNC6692 establishes a PsExec session to a victim system through the SNOWGLAZE tunnel.T1046 · Network Service DiscoveryA Python script scans the local network for services on ports 135, 445, and 3389.T1056.003 · Web Portal CaptureA phishing configuration panel prompts victims to enter mailbox credentials, which are harvested and exfiltrated.T1059.001 · PowerShellThe article reports an obfuscated PowerShell script in the separate PhantomBackdoor campaign and SNOWBASIN's ability to execute commands through powershell.exe.T1059.010 · AutoHotKey & AutoITAn AutoHotkey script downloaded from an attacker-controlled AWS S3 bucket performs reconnaissance and installs malware.T1071.001 · Web ProtocolsSNOWGLAZE uses WebSocket communications for its tunnel to the C2 server.T1105 · Ingress Tool TransferSNOWBELT downloads additional files, including SNOWGLAZE, SNOWBASIN, scripts, and a ZIP archive.T1176 · Software ExtensionsUNC6692 installs the malicious SNOWBELT browser extension in Microsoft Edge.T1204.001 · Malicious LinkTargets are instructed to click the phishing link to install a local patch.T1550.002 · Pass the HashUNC6692 uses Pass-the-Hash with elevated users' password hashes to move laterally to domain controllers.T1566.002 · Spearphishing LinkUNC6692 shares a phishing link with targets through Microsoft Teams chat.T1567.002 · Exfiltration to Cloud StorageThe article says harvested credentials are exfiltrated to another Amazon S3 bucket.T1572 · Protocol TunnelingSNOWGLAZE creates an authenticated WebSocket tunnel between the victim's internal network and the attackers' C2 server.

People

Alexa FeminellaReliaQuest researcher quoted on the share of observed incidents targeting senior-level employees.John DilgenReliaQuest researcher quoted on the share of observed incidents targeting senior-level employees.Josh KelleyMandiant researcher credited with describing UNC6692's gatekeeper script and sandbox-evasion behavior.JP GlabMandiant researcher credited with describing UNC6692's gatekeeper script and sandbox-evasion behavior.Muhammad UmairMandiant researcher credited with describing UNC6692's gatekeeper script and sandbox-evasion behavior.Tufail AhmedMandiant researcher credited with describing UNC6692's gatekeeper script and sandbox-evasion behavior.

Threat Actors

Black BastaThe article says the email-bombing followed by helpdesk impersonation tactic was long used by former Black Basta affiliates; it does not attribute the UNC6692 campaign to Black Basta.UNC6692Mandiant attributes the email-bombing and Microsoft Teams helpdesk-impersonation campaign, and deployment of the SNOW malware suite, to this activity cluster.

Malware

PhantomBackdoorimpersonation on Microsoft Teams to guide victims into executing a WebSocket-based trojan dubbed PhantomBackdoor via an obfuscated PowerShell script retrieved from an external server.SnowbasinThe attack chain uses AWS S3-hosted payloads, a malicious Edge extension (SNOWBELT), tunneling (SNOWGLAZE), and a persistent backdoor (SNOWBASIN) to enable lateral movement, credential theft, and data exfiltration.SNOWBELTThe attack chain uses AWS S3-hosted payloads, a malicious Edge extension (SNOWBELT), tunneling (SNOWGLAZE), and a persistent backdoor (SNOWBASIN) to enable lateral movement, credential theft, and data exfiltration.SnowglazeThe attack chain uses AWS S3-hosted payloads, a malicious Edge extension (SNOWBELT), tunneling (SNOWGLAZE), and a persistent backdoor (SNOWBASIN) to enable lateral movement, credential theft, and data exfiltration.

Products

AWS S3The attack chain uses AWS S3-hosted payloads, a malicious Edge extension (SNOWBELT), tunneling (SNOWGLAZE), and a persistent backdoor (SNOWBASIN) to enable lateral movement, credential theft, and data exfiltration.Microsoft EdgeIf the user is not using Microsoft Edge, the page displays a persistent overlay warning.Microsoft TeamsUNC6692 campaigns combine large-scale email-bombing with Microsoft Teams helpdesk impersonation to trick targets—especially senior executives—into installing a malicious “Mailbox Repair and Sync Utility” that delivers

Tools

AutoHotkeysenior executives—into installing a malicious “Mailbox Repair and Sync Utility” that delivers an AutoHotkey script and a modular SNOW malware toolkit.FTK ImagerPost-exploitation includes LSASS memory dumps, Pass-the-Hash lateral movement, PsExec/RDP via SNOWGLAZE, forensic image capture with FTK Imager, and exfiltration using LimeWire.LimeWirePost-exploitation includes LSASS memory dumps, Pass-the-Hash lateral movement, PsExec/RDP via SNOWGLAZE, forensic image capture with FTK Imager, and exfiltration using LimeWire.PsExecPost-exploitation includes LSASS memory dumps, Pass-the-Hash lateral movement, PsExec/RDP via SNOWGLAZE, forensic image capture with FTK Imager, and exfiltration using LimeWire.

Related Articles