Loading malware…
SNOW is a custom modular malware suite associated with the threat cluster UNC6692 and used in socially engineered intrusions that abuse Microsoft Teams helpdesk impersonation. The intrusion chain commonly begins with email bombing to create urgency and confusion, followed by contact from an attacker posing as IT support through external Teams messaging. Victims are persuaded to follow a fake remediation workflow and execute a purported patch, after which SNOW is deployed on the compromised Windows host.
The SNOW ecosystem has been described as comprising multiple components, including SNOWBELT, a malicious Chromium-based browser extension used for stealth, persistence, and command relay; SNOWGLAZE, a tunneling utility that supports proxying and covert operator communications; and SNOWBASIN, a local HTTP backdoor that enables remote command execution and host interaction. Observed behavior includes hidden or headless browser launches to install the extension, scheduled-task or startup-based persistence, command execution, screenshot capture, file operations, credential harvesting, and data exfiltration. The tooling is designed to blend command-and-control and exfiltration traffic with legitimate cloud services and normal Windows activity, complicating detection.
Post-compromise activity attributed to UNC6692 includes internal reconnaissance, scanning for reachable services, lateral movement using stolen credentials, and broader domain compromise objectives. Reported follow-on actions include credential theft, pass-the-hash-style expansion, access to domain controllers, and theft of sensitive directory data. The malware suite is therefore best characterized as a backdoor platform used to establish durable access and support hands-on-keyboard post-exploitation and exfiltration in enterprise environments.
Separately, Snow has also been identified in another context as an ITG23-related crypter first observed in late 2022 and likely the successor to Hexa based on code overlap. That usage ties Snow to malware protection and obfuscation activity around families such as Qakbot. Because the same name is used for both a UNC6692 malware suite and an ITG23-linked crypter, the label is overloaded and should be interpreted carefully in context.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The second is Snow, which was first observed in December 2022. Its introduction coincided with the retirement of Hexa, and code overlap between the two indicates that Snow is likely Hexa’s successor.
A newly identified threat group tracked as UNC6692 is hijacking Microsoft Teams to install a custom malware suite called SNOW.
Secondary Payload Deployment: Rapid execution of malicious loaders or novel backdoors (such as SNOW malware) within minutes of session establishment.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
That button triggers a login prompt, and the page asks for credentials multiple times under the guise of verification... The captured logins are then quietly sent to a cloud location controlled by the attacker.
The attack begins with a wave of spam emails sent to a target’s inbox, creating chaos and urgency. Once the victim is overwhelmed, the same attacker reaches out through Microsoft Teams, posing as an IT support agent offering to fix the problem they caused.
Once a victim accepts the fake Teams invitation, the attacker sends a link claiming to install a patch that stops the spam.
Clicking it downloads a renamed AutoHotkey binary along with a script... Once the AutoHotkey script runs... It includes... a Python based tunneling tool.
Clicking it downloads a renamed AutoHotkey binary along with a script sharing the same file name... Once the AutoHotkey script runs, it performs reconnaissance and installs SNOWBELT.
That button triggers a login prompt, and the page asks for credentials multiple times under the guise of verification... The captured logins are then quietly sent to a cloud location controlled by the attacker.
That button triggers a login prompt, and the page asks for credentials multiple times under the guise of verification... The captured logins are then quietly sent to a cloud location controlled by the attacker.
Attackers pose as IT helpdesk staff... the attacker contacts the victim through a Teams chat request from an account outside the organization, posing as a helpful colleague.
That button triggers a login prompt, and the page asks for credentials multiple times under the guise of verification... The captured logins are then quietly sent to a cloud location controlled by the attacker.
According to Google’s Mandiant researchers, the attacker uses “email bombing” tactics to create urgency, then contact targets via Microsoft Teams, posing as IT helpdesk agents.
Once the AutoHotkey script runs, it performs reconnaissance...
The toolkit also supports screenshot capture, file exfiltration, and session termination...
Clicking it downloads a renamed AutoHotkey binary along with a script sharing the same file name, pulled from an attacker controlled cloud bucket.
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.