Tool
LimeWire
- First Reported
- Apr 23, 2026
- Latest Reported
- Apr 28, 2026
Reported Context (5)
- The attackers used AutoHotkey stagers and a malicious Chromium extension (SNOWBELT) to deploy tools like Snowglaze and Snowbasin, extract LSASS memory via LimeWire, and move laterally with pass-the-hash. UNC6692 Uses Teams Social Engineering and Custom Malware to Steal Credentials
- The threat actor then dumped the LSASS process memory from the backup server and exfiltrated it via LimeWire to extract usernames, passwords, and user account hashes from it. UNC6692 Uses Email Bombing and Fake IT Support to Deploy Snow Malware
- The group conducts deep network compromise—dumping LSASS, using pass-the-hash, and exfiltrating Active Directory data (via FTK Imager and LimeWire) to steal credentials and take over domains. Mandiant Details UNC6692’s Snow Malware and Attack Chain
- Post-exploitation includes LSASS memory dumps, Pass-the-Hash lateral movement, PsExec/RDP via SNOWGLAZE, forensic image capture with FTK Imager, and exfiltration using LimeWire. UNC6692 Uses Teams Help Desk Impersonation to Deploy SNOW Malware
- movement, and extracted LSASS memory and AD artifacts (NTDS.dit, SAM, SYSTEM) which were exfiltrated via LimeWire. Google Details UNC6692’s SNOW Malware and Teams-Based Intrusion
Malware (5)
People (6)
Threat Actors (2)
MITRE ATT&CK (32)
Vendors (3)
Products (7)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.