Snowglaze

Reported Context (6)

The attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash. UNC6692 Uses Teams Social Engineering and Custom Malware to Steal Credentials
The operation, attributed to UNC6692, uses email flooding, Teams phishing and a fake “Mailbox Repair Utility” to deploy the SnowBelt extension and secondary tools like SnowGlaze and SnowBasin. Mandiant Details UNC6692 Campaign Impersonating Microsoft Teams Support
Next, the attackers used the malicious extension to download additional payloads, including AutoHotkey scripts, a ZIP archive, the Snowglaze tunnel, and the Snowbasin malware, from an attacker-controlled AWS S3 bucket. UNC6692 Uses Email Bombing and Fake IT Support to Deploy Snow Malware
SnowGlaze creates a WebSocket tunnel and SOCKS proxy to mask C2 communications and route arbitrary TCP traffic through infected hosts. Mandiant Details UNC6692’s Snow Malware and Attack Chain
The attack chain uses AWS S3-hosted payloads, a malicious Edge extension (SNOWBELT), tunneling (SNOWGLAZE), and a persistent backdoor (SNOWBASIN) to enable lateral movement, credential theft, and data exfiltration. UNC6692 Uses Teams Help Desk Impersonation to Deploy SNOW Malware

Malware (4)

People (6)

Threat Actors (2)

MITRE ATT&CK (32)

Vendors (3)

Products (7)

Tools (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.