SNOWGLAZE
SNOWGLAZE is a Python-based tunneler in the SNOW malware ecosystem used by threat cluster UNC6692. It runs on both Windows and Linux and creates a persistent, authenticated WebSocket tunnel between a victim's internal network and attacker-controlled command-and-control infrastructure, including Heroku subdomains. The malware wraps traffic in JSON objects and Base64-encodes it for transfer over WebSockets, and it can route arbitrary TCP traffic through the victim via a SOCKS proxy to mask communications. In observed intrusions, SNOWGLAZE was delivered after initial compromise by the SNOWBELT malicious Chromium extension, alongside SNOWBASIN, AutoHotkey scripts, and a portable Python environment. It was used to support deeper network access, reconnaissance, and lateral movement; reporting states UNC6692 established PsExec sessions through the SNOWGLAZE tunnel and initiated RDP sessions via the tunnel to internal systems such as backup servers. The broader intrusion chain relied on Microsoft Teams helpdesk impersonation, email bombing, and a fake Mailbox Repair Utility to socially engineer victims. A reported WebSocket IOC associated with the campaign is wss://sad4w7h913-b4a57f9c36eb.herokuapp.com/ws.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SnowGlaze is a Python-based tunneler that runs in both Windows and Linux environments and manages the external communication. It creates an authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) infrastructure, such as a Heroku subdomain.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
5 techniques
Initial Access
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist. Either way, they install the SNOW malware suite.
Once it's clicked, it leads to the download of an AutoHotkey script from a threat actor-controlled AWS S3 bucket.
Step 2 — The helper arrives on Teams Right away, an external Microsoft Teams account named “IT Helpdesk” messages the victim. The hacker offers to fix the email issue immediately.
Execution
4 techniques
Execution
The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance... SnowGlaze is a Python-based tunneler... Finally, SnowBasin is a Python bindshell...
...a ZIP archive containing a portable Python executable and required libraries. SnowGlaze is a Python-based tunneler... Finally, SnowBasin is a Python bindshell...
Persistence
1 technique
Persistence
Discovery
3 techniques
Discovery
Lateral Movement
3 techniques
Lateral Movement
Command and Control
7 techniques
Command and Control
It also disguises malicious traffic by wrapping data in JSON objects and Base64 encoding it for transfer via WebSockets, which makes it look like legitimate, standard encrypted web traffic.
SNOWGLAZE is a Python tunneler that creates a persistent encrypted channel back to attacker infrastructure.
It creates an authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) infrastructure, such as a Heroku subdomain.
SnowGlaze is a Python-based tunneler... It creates an authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) infrastructure...
SNOWGLAZE is a Python-based tunneler to create a secure, authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) server.
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Python-based tunneling component in the SNOW malware suite that establishes a persistent encrypted channel to attacker-controlled infrastructure.
A Python-based tunneling tool that establishes a persistent encrypted channel to attacker infrastructure.
An additional malware tool downloaded by SnowBelt as part of the intrusion chain.
A Python-based tunneling component that manages external communications by creating authenticated WebSocket tunnels between the victim network and attacker C2, disguising traffic in JSON and Base64 over WebSockets.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.