UNC6692 Uses Email Bombing, IT Impersonation and Quick Assist to Deploy Edgecution

Jul 22, 2026 · Original article ↗

Summary

eSentire details a UNC6692 phishing campaign that used email bombing and Microsoft Teams IT impersonation to gain Quick Assist access, steal Office 365 credentials, and attempt to install the Edgecution backdoor.

Key points

eSentire attributed a July 2026 targeted campaign affecting a Software industry customer to UNC6692.
Attackers flooded the victim's inbox, then posed as internal IT support on Microsoft Teams and used Quick Assist to gain hands-on access.
A phishing site hosted on Amazon S3 mimicked Office 365, captured passwords, and delivered AutoHotkey tools used to install Edgecution.
Edgecution combines a malicious Edge extension with a Python native messaging host, enabling keyword-based browser monitoring and arbitrary command, Python, and PowerShell execution on the host.
The malware uses scheduled-task persistence, obfuscated strings, and a WebSocket connection to its command-and-control server; the stager also changes its Edge launch options when it detects CrowdStrike or Sophos.
eSentire isolated the affected host, assisted with remediation, and said it was developing detection content; its recommendations include restricting unrecognized external Teams contacts and using endpoint detection and response.

Article Details

Attack Vectors: Email bombing created a disruption that UNC6692 used as a pretext for contacting the victim through an external Microsoft Teams account while impersonating internal IT support.
The victim was instructed to start Quick Assist and grant remote access. The attackers then visited an Amazon S3-hosted phishing site and downloaded AutoHotkey and a malicious installation script.
The phishing site imitated Office 365 and offered an updates registration form that captured passwords. Captured credentials were uploaded to an S3 bucket through PUT requests.
The AutoHotkey stager downloaded a password-protected archive, reconstructed its ZIP header, registered a native messaging host, and created a scheduled task to launch a malicious browser extension.
A malicious browser extension paired with a Python-based native messaging host enabled website monitoring, arbitrary command execution, file writes, process enumeration, and host fingerprinting.
The phishing site also supported alternative delivery options that copied Batch or PowerShell scripts to the victim's clipboard.
Defensive Notes: eSentire isolated the affected host to contain the infection and assisted the customer with remediation.
Restrict or disable external collaboration contacts from unrecognized tenants where business requirements permit; otherwise require explicit approval for external contacts.
Provide phishing and security awareness training using realistic social-engineering scenarios.
Use continuous, multi-signal managed detection and response for threat hunting, containment, and rapid response; at minimum, deploy next-generation antivirus or endpoint detection and response.
The stager checks for specific endpoint security software and changes browser launch parameters to avoid displaying a window.
The archive's missing ZIP magic bytes were assessed as a likely evasion measure against network detections for ZIP downloads.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`d1jp293q9tvi92[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d23l50n6ubud7p[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d2g6dl71gua1qa[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d3434apz0x8t7d[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d385m5skczp5q5[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d3nh8sl98s2554[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
DOMAIN	`d7xpwoah6gdv2[.]cloudfront[.]net`	CloudFront hostname listed as Edgecution C2 infrastructure.
SHA256	`232bca658c585627830623fcdce56647dc291666b25c901ee56212681198067a`	Hash provided for the phishing site analyzed in the attack.
SHA256	`da1cf68c9dc1cebcebf8ec7d1cf99ac9c0291db7b21bf279b9cad24c7a49948c`	Hash provided for the Edgecution archive analyzed in the article.
SHA256	`e88c196a86c74ea0e53dfe77c93f577cb441ee590756cf7f3284522a2d6a6be5`	Malicious AutoHotkey stager that downloads and installs Edgecution.
URL	`hxxps[:]//app5805[.]s3[.]us-east-1[.]amazonaws[.]com/js/patch3265343[.]a`	Specific S3-hosted Edgecution archive download URL.
URL	`hxxps[:]//app7040[.]s3[.]us-east-1[.]amazonaws[.]com/patch[.]html`	S3-hosted phishing page used in the attack.
URL	`hxxps[:]//app7570[.]s3[.]us-east-1[.]amazonaws[.]com/js/set36418917[.]a`	Specific S3-hosted Edgecution archive download URL.
URL	`hxxps[:]//app7570[.]s3[.]us-east-1[.]amazonaws[.]com/js/set36418917[.]ahk`	Specific S3-hosted malicious AutoHotkey stager download URL.
URL	`hxxps[:]//app7570[.]s3[.]us-east-1[.]amazonaws[.]com/js/set36418917[.]exe`	Attacker-used S3 resource distributing AutoHotkey for execution of the malicious stager.
URL	`hxxps[:]//cloud3043[.]s3[.]us-east-1[.]amazonaws[.]com/patch[.]html`	S3-hosted phishing page listed in the indicators.
URL	`hxxps[:]//cloud48949[.]s3[.]us-east-1[.]amazonaws[.]com/patch[.]html`	S3-hosted phishing page listed in the indicators.
URL	`hxxps[:]//cloud9069[.]s3[.]us-east-1[.]amazonaws[.]com/patch[.]html`	S3-hosted phishing page listed in the indicators.