Loading malware…
SNOWBASIN is a Python-based remote access backdoor and bindshell used as part of the SNOW malware ecosystem associated with the UNC6692 threat cluster. It is deployed in intrusions that rely on social engineering rather than software exploitation, most notably campaigns in which attackers impersonate IT helpdesk personnel over Microsoft Teams after email-bombing targets. In observed attack chains, victims are lured into running staged payloads that install the broader SNOW toolset, including the SNOWBELT browser-extension backdoor and the SNOWGLAZE tunneling component, after which SNOWBASIN provides direct interactive control of the compromised host.
SNOWBASIN operates as a persistent local HTTP server and serves as the execution component of the malware suite. It enables remote command execution through Windows shell interpreters, supports screenshot capture, file upload and download, data staging for exfiltration, and operator-directed self-termination. In the SNOW architecture, commands can be relayed from SNOWBELT to SNOWBASIN for execution, while SNOWGLAZE provides an authenticated WebSocket tunnel that helps route traffic between the victim environment and attacker-controlled infrastructure. This modular design allows the operators to blend browser-based persistence, covert tunneling, and host-level command execution.
The malware has been observed in enterprise intrusions focused on credential theft, internal reconnaissance, lateral movement, and theft of sensitive directory data. After deployment, the broader toolchain has been used to scan internal networks, support remote administration activity, and facilitate follow-on compromise of higher-value systems including domain infrastructure. SNOWBASIN is therefore best characterized as the host-resident backdoor component of a custom intrusion framework built for stealthy persistence, remote tasking, and support of deeper post-compromise operations in Windows enterprise environments.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tool SNOWBASIN Local HTTP backdoor providing a direct command channel on the compromised host
22 distinct techniques documented for this family, organized by ATT&CK tactic.
its systematic abuse of legitimate cloud services for every stage of the attack payload delivery, credential exfiltration, C2 infrastructure, and data staging, all of which relied on trusted platforms like AWS S3 and Heroku.
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist. Either way, they install the SNOW malware suite.
Once it's clicked, it leads to the download of an AutoHotkey script from a threat actor-controlled AWS S3 bucket.
Step 2 — The helper arrives on Teams Right away, an external Microsoft Teams account named “IT Helpdesk” messages the victim. The hacker offers to fix the email issue immediately.
The fake helpdesk worker prompts the user to click a link that supposedly installs a local patch that prevents email spamming. This directs victims to a landing page masquerading as a 'Mailbox Repair Utility'...
Step 2 — The helper arrives on Teams Right away, an external Microsoft Teams account named “IT Helpdesk” messages the victim. The hacker offers to fix the email issue immediately.
The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance... SnowGlaze is a Python-based tunneler... Finally, SnowBasin is a Python bindshell...
SNOWBASIN... enable[s] remote command execution via "cmd.exe" or "powershell.exe"
SNOWBASIN... enable[s] remote command execution via "cmd.exe" or "powershell.exe"
...a ZIP archive containing a portable Python executable and required libraries. SnowGlaze is a Python-based tunneler... Finally, SnowBasin is a Python bindshell...
...to trick victims into installing a fake fix for email issues. The attack delivered AutoHotKey-based loaders...
Once it's clicked, it leads to the download of an AutoHotkey script from a threat actor-controlled AWS S3 bucket.
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist. Either way, they install the SNOW malware suite.
SNOWBELT is a malicious Chromium browser extension that acts as a backdoor, harvesting saved credentials and session cookies.
Attacker commands (such as whoami or net user) are sent through the SnowGlaze tunnel...
...allowing deeper network access and reconnaissance.
It serves as a persistent backdoor, operating as a local HTTP server and typically listening on port 8000, allowing remote command execution, screenshot capture, and data staging for exfiltration.
...allowing remote command execution, screenshot capture, and data staging for exfiltration.
It serves as a persistent backdoor... allowing remote command execution, screenshot capture, and data staging for exfiltration.
Finally, SnowBasin is a Python bindshell providing interactive control over the infected system.
Once installed, the extension can download additional components, including malware tools dubbed SnowGlaze and SnowBasin, along with AutoHotkey scripts and a portable Python environment used to run further malicious code.
SNOWBASIN is a remote access backdoor.
...credentials and metadata are sent to an attacker-controlled Amazon S3 bucket... SnowBasin is a Python bindshell... allowing... data staging for exfiltration.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.