UNC6692

UNC6692 is a financially motivated cybercriminal threat cluster tracked by Mandiant and Google Threat Intelligence Group, with documented activity dating to at least December 2025. It compromises corporate environments through email bombing, Microsoft Teams helpdesk impersonation, credential phishing, and custom malware. The group also operates as an initial access broker, supplying access to ransomware operations including Payouts King. Confirmed targeting includes the software industry; its geographic origin and targeting scope are not established. Intrusions typically begin with a flood of unsolicited email, followed by contact from an external Teams account impersonating internal IT support. The attacker offers to resolve the disruption and directs the victim to a fake mailbox-repair page or persuades them to grant remote access through Microsoft Quick Assist. Credential-harvesting pages deliberately reject password submissions to encourage repeated entry. AutoHotkey-based staging delivers malicious browser extensions and supporting payloads, while legitimate cloud services provide payload hosting, command-and-control, and exfiltration infrastructure. UNC6692 uses the modular SNOW malware suite: SNOWBELT, a JavaScript backdoor implemented as a Chromium browser extension; SNOWGLAZE, a Python tunneler supporting authenticated WebSocket tunnels and SOCKS proxying; and SNOWBASIN, a Python backdoor providing remote command execution, screenshots, and file transfer. Persistence mechanisms include extension registration, scheduled tasks, and startup shortcuts. The group has also deployed Edgecution, a malicious Microsoft Edge extension paired with a Python native messaging host that supports browser monitoring, host reconnaissance, arbitrary command execution, and file operations. Hidden browser execution, environment-aware staging, and abuse of trusted cloud infrastructure help conceal its activity. Post-compromise operations include internal network scanning, credential extraction from LSASS memory, lateral movement using PsExec, RDP, and pass-the-hash, and access to domain controllers. UNC6692 has collected Active Directory databases and sensitive registry-hive data using FTK Imager and exfiltrated stolen material through file-sharing services. Similarity to other Teams-based social-engineering campaigns does not establish common ownership or affiliation.