Google Details UNC6692’s SNOW Malware and Teams-Based Intrusion
Summary
Google Threat Intelligence Group details UNC6692’s Teams-based social engineering and its modular SNOW malware suite, tracing credential theft, persistence, lateral movement, and exfiltration through a victim environment.
Key points
- GTIG attributes a multistage intrusion to UNC6692, which followed a mass email campaign with a Microsoft Teams message impersonating helpdesk staff and a fake mailbox-repair page.
- The page harvested credentials and staged a renamed AutoHotKey binary and script; the attackers installed SNOWBELT, a malicious Chromium extension, with startup and scheduled-task persistence.
- SNOWBELT acted as a browser backdoor, SNOWGLAZE as a Python WebSocket tunnel and SOCKS proxy, and SNOWBASIN as a Python HTTP backdoor supporting command execution, screenshots, and file handling.
- Investigators observed internal scans of ports 135, 445, and 3389, followed by PsExec and RDP activity through the SNOWGLAZE tunnel.
- The attackers extracted LSASS memory and Active Directory data, including NTDS.dit and registry hives; the article says the collected material was exfiltrated via LimeWire.
- The malware used cloud services for hosting and command-and-control, along with anti-analysis checks, time-based domain generation, and AES-GCM-protected data.
- The report provides indicators and YARA rules and recommends monitoring browser activity, unauthorized cloud transfers, extension installations, and outbound WebSocket or SOCKS-like traffic.
Article Details
- Attack Vectors
- UNC6692 used a high-volume email campaign followed by Microsoft Teams messages impersonating IT helpdesk personnel to persuade victims to open a phishing link.
- The phishing landing page harvested credentials and staged a renamed AutoHotkey binary and script from attacker-controlled AWS S3 infrastructure.
- The attackers installed SNOWBELT as a Chromium extension and used scheduled tasks and a Startup-folder shortcut to maintain persistence.
- SNOWGLAZE provided a WebSocket tunnel and SOCKS proxy; the attackers used PsExec and RDP through the tunnel for lateral movement.
- The attackers extracted LSASS memory and domain-controller artifacts, including NTDS.dit and SAM, SYSTEM, and SECURITY hives, then exfiltrated data using LimeWire and attacker-controlled cloud storage.
- Defensive Notes
- Monitor browser activity, unauthorized cloud uploads and downloads, and unapproved browser-extension installations.
- Look for outbound WebSocket and SOCKS-like traffic, and correlate activity across browsers, local Python environments, and cloud egress points.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudfront-021[.]s3[.]us-west-2[.]amazonaws[.]com | S3 host identified as SNOWBELT C2 infrastructure. |
| DOMAIN | service-page-11369-28315-outlook[.]s3[.]us-west-2[.]amazonaws[.]com | Attacker-used S3 host identified as the destination for uploading a text file. |
| DOMAIN | service-page-18968-2419-outlook[.]s3[.]us-west-2[.]amazonaws[.]com | Attacker-controlled S3 host used to receive harvested credentials and metadata. |
| DOMAIN | service-page-25144-30466-outlook[.]s3[.]us-west-2[.]amazonaws[.]com | Attacker-controlled S3 host used to serve the phishing page and initial AutoHotKey payloads. |
| SHA256 | 2fa987b9ed6ec6d09c7451abd994249dfaba1c5a7da1c22b8407c461e62f7e49 | Hash reported for a SNOW malware-related file in the article's file indicators. |
| SHA256 | 6e6dab993f99505646051d2772701e3c4740096ff9be63c92713bcb7fcddf9f7 | SHA-256 of the SNOWBELT dream.html resource. |
| SHA256 | 7f1d71e1e079f3244a69205588d504ed830d4c473747bb1b5c520634cc5a2477 | SHA-256 of the SNOWBELT background.js service worker. |
| SHA256 | c8940de8cb917abe158a826a1d08f1083af517351d01642e6c7f324d0bba1eb8 | Hash listed among file indicators associated with the reported intrusion. |
| SHA256 | ca390b86793922555c84abc3b34406da2899382c617f9dcf83a74ac09dd18190 | SHA-256 of the SNOWBELT dream.js resource. |
| SHA256 | de200b79ad2bd9db37baeba5e4d183498d450494c71c8929433681e848c3807f | SHA-256 of the SNOWBELT helper.html resource. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe attackers extracted LSASS process memory from a backup server.T1003.002 · Security Account ManagerFTK Imager was used to collect the SAM registry hive from a domain controller.T1003.003 · NTDSFTK Imager was used to collect NTDS.dit from a domain controller.T1021.001 · Remote Desktop ProtocolThe attackers initiated an RDP session from the victim system to a backup server through the SNOWGLAZE tunnel.T1046 · Network Service DiscoveryA Python script scanned the local network for ports 135, 445, and 3389.T1053.005 · Scheduled TaskScheduled tasks launched Edge with the SNOWBELT extension and monitored headless Edge processes.T1059.006 · PythonThe attackers used a Python script to scan the local network, and SNOWGLAZE and SNOWBASIN were Python-based components.T1059.010 · AutoHotKey & AutoITA renamed AutoHotkey binary and script were downloaded and executed to bootstrap the intrusion.T1071.001 · Web ProtocolsSNOWGLAZE used WebSocket communications for its C2 tunnel, while SNOWBELT also used HTTP requests to relay commands locally.T1090 · ProxySNOWGLAZE supported SOCKS proxy connections that routed arbitrary TCP traffic through the infected host.T1176.001 · Browser ExtensionsSNOWBELT was deployed as a malicious Chromium browser extension and used as a persistent foothold.T1204.001 · Malicious LinkThe victim was prompted to click a link to install a purported local patch, opening the malicious landing page.T1547.001 · Registry Run Keys / Startup FolderA shortcut to an AutoHotkey script was added to the Windows Startup folder.T1566.002 · Spearphishing LinkUNC6692 sent phishing links through Microsoft Teams messages posing as helpdesk assistance.T1567.002 · Exfiltration to Cloud StorageThe phishing page uploaded stolen credentials and metadata to attacker-controlled S3 buckets.
Threat Actors
Malware
Snowbasinlanding page, and staged downloads to deliver a modular SNOW malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) that enabled internal reconnaissance, credential theft, lateral movement, and exfiltration.SNOWBELTa malicious phishing landing page, and staged downloads to deliver a modular SNOW malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) that enabled internal reconnaissance, credential theft, lateral movement, andSnowglazephishing landing page, and staged downloads to deliver a modular SNOW malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) that enabled internal reconnaissance, credential theft, lateral movement, and exfiltration.
Vendors
Amazon(‘validated credentials and metadata are uploaded directly to an attacker-controlled Amazon S3 bucket’)MicrosoftGroup attributes a multistage intrusion to UNC6692 that used persistent social engineering via Microsoft Teams, a malicious phishing landing page, and staged downloads to deliver a modular SNOW malware
Products
Microsoft EdgeOne task to start a windowless Microsoft Edge process that loads the SNOWBELT extension and another to identify and terminate Microsoft Edge processes that do not have CoreUIComponents.dll loaded.Microsoft TeamsGroup attributes a multistage intrusion to UNC6692 that used persistent social engineering via Microsoft Teams, a malicious phishing landing page, and staged downloads to deliver a modular SNOW malware ecosystemMicrosoft Windows[T1053.005 ] Scheduled Task – Used Windows Scheduled Task arguments to start Edge with –load-extension pointing to the SNOWBELT extension.
Tools
AutoHotkeyThe campaign abused trusted cloud services (AWS S3, CloudFront, Heroku) for C2 and payload hosting and relied on a malicious Chromium extension and AutoHotKey-based persistence to maintain long-term access.FTK Imager[T1003.002 ] Security Account Manager – Collected SAM registry hives via FTK Imager for credential extraction.LimeWiremovement, and extracted LSASS memory and AD artifacts (NTDS.dit, SAM, SYSTEM) which were exfiltrated via LimeWire.PsExecUNC6692 performed internal reconnaissance (port scans for 135/445/3389), used PsExec and RDP via the SNOWGLAZE tunnel for lateral movement, and extracted LSASS memory and AD artifacts (NTDS.dit, SAM, SYSTEM) which were