Tool
FTK Imager
- First Reported
- Apr 23, 2026
- Latest Reported
- Apr 27, 2026
Reported Context (4)
- Next, UNC6692 used Pass-The-Hash to access the network’s domain controller, downloaded FTK Imager to it, used the tool to mount the local storage drive and write the Active Directory database file, Security Account UNC6692 Uses Email Bombing and Fake IT Support to Deploy Snow Malware
- The group conducts deep network compromise—dumping LSASS, using pass-the-hash, and exfiltrating Active Directory data (via FTK Imager and LimeWire) to steal credentials and take over domains. Mandiant Details UNC6692’s Snow Malware and Attack Chain
- Post-exploitation includes LSASS memory dumps, Pass-the-Hash lateral movement, PsExec/RDP via SNOWGLAZE, forensic image capture with FTK Imager, and exfiltration using LimeWire. UNC6692 Uses Teams Help Desk Impersonation to Deploy SNOW Malware
- [T1003.002 ] Security Account Manager – Collected SAM registry hives via FTK Imager for credential extraction. Google Details UNC6692’s SNOW Malware and Teams-Based Intrusion
Malware (5)
People (6)
Threat Actors (2)
MITRE ATT&CK (31)
Vendors (2)
Products (6)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.