UNC6692

UNC6692 is a newly identified threat cluster tracked by Google Threat Intelligence Group (GTIG) and Mandiant. The group is associated with a multistage intrusion campaign observed in late December 2025 that relies on social engineering rather than software exploitation. Its core tradecraft combines email bombing with Microsoft Teams helpdesk impersonation: attackers flood targets with spam, then contact them from external Teams accounts while posing as IT support and direct them to a fake mailbox repair or sync utility. The phishing workflow harvests credentials, including through a repeated-password prompt designed to capture the password twice, and stages malware from attacker-controlled cloud infrastructure including Amazon S3. UNC6692 abuses trusted enterprise and cloud services, including Microsoft Teams, AWS S3, and Heroku, for payload delivery, command and control, and exfiltration to blend into legitimate traffic. The group deploys a custom modular malware ecosystem referred to as Snow, consisting of SNOWBELT, SNOWGLAZE, and SNOWBASIN. SNOWBELT is a malicious Chromium browser extension, often masquerading as "MS Heartbeat" or "System Heartbeat," used for initial foothold, persistence, and command relay. SNOWGLAZE is a Python-based tunneler that creates authenticated WebSocket tunnels and can proxy traffic. SNOWBASIN is a Python backdoor/bindshell that enables remote command execution, screenshot capture, file transfer, and data staging. The intrusion chain also uses AutoHotkey binaries and scripts and a portable Python environment. Post-compromise activity attributed to UNC6692 includes reconnaissance, internal network scanning for ports 135, 445, and 3389, use of PsExec and RDP for lateral movement, LSASS memory extraction, Pass-the-Hash movement to domain controllers, and theft of sensitive data including NTDS.dit and registry hives using FTK Imager, with exfiltration via LimeWire. Reporting also notes the group has targeted enterprise users, including executives and senior employees, through Teams-based helpdesk impersonation. Although the tactics resemble social-engineering operations associated with groups such as ShinyHunters, Scattered Lapsus$ Hunters, Scattered Spider, and activity long associated with former Black Basta affiliates, the provided reporting explicitly states there is no observed overlap between UNC6692 and ShinyHunters or Scattered Lapsus$ Hunters. No nation-state attribution is stated in the provided content. Known alias in the provided content: UNC6692.