SNOWBELT
SNOWBELT is a malicious Chromium browser extension and JavaScript-based backdoor used in the SNOW malware ecosystem. It is associated with threat cluster UNC6692 and has been deployed in social-engineering campaigns that used email bombing and Microsoft Teams helpdesk impersonation to trick victims into installing a fake mailbox repair or spam-fix utility. The infection chain described in the reporting involves a dropper that downloads and executes AutoHotkey binaries and scripts, performs initial reconnaissance, and installs SNOWBELT on Microsoft Edge, including via headless mode with the "--load-extension" switch. SNOWBELT was not distributed through the Chrome Web Store and instead was delivered through social engineering. It often masquerades as "MS Heartbeat" or "System Heartbeat." SNOWBELT provides an initial foothold and persistence through the browser extension registration system, and reporting also states it maintained persistence via a Windows Startup folder shortcut, scheduled tasks, and a headless Edge process. Its capabilities include acting as a backdoor, harvesting saved credentials and session cookies, maintaining access to corporate accounts, and relaying attacker commands to additional malware components. UNC6692 used SNOWBELT to download further payloads including SNOWGLAZE, a Python-based WebSocket tunneler, SNOWBASIN, a Python backdoor/bindshell, additional AutoHotkey scripts, and a portable Python environment. Reported follow-on activity in the same intrusion set included internal reconnaissance, port scanning, lateral movement, LSASS memory extraction, Pass-the-Hash, and exfiltration of sensitive data. High-confidence indicators and artifacts mentioned in the content include the masquerade names "MS Heartbeat" and "System Heartbeat," use of AWS S3-hosted delivery infrastructure, and related campaign infrastructure such as wss://sad4w7h913-b4a57f9c36eb.herokuapp.com/ws and S3 domains including service-page-25144-30466-outlook.s3.us-west-2.amazonaws.com, cloudfront-021.s3.us-west-2.amazonaws.com, and service-page-11369-28315-outlook.s3.us-west-2.amazonaws.com.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance and installs a malicious Chromium browser extension called SnowBelt. ... SnowBelt, a JavaScript-based backdoor delivered as a Chromium browser extension, gives the attacker an initial foothold and maintains persistence via the browser's extension registration system. It often hides behind names like "MS Heartbeat" or "System Heartbeat."
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
6 techniques
Initial Access
SnowBelt functions as a backdoor that allows attackers to maintain access to corporate accounts and move through internal systems without repeated authentication.
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist. Either way, they install the SNOW malware suite.
Once it's clicked, it leads to the download of an AutoHotkey script from a threat actor-controlled AWS S3 bucket.
Step 2 — The helper arrives on Teams Right away, an external Microsoft Teams account named “IT Helpdesk” messages the victim. The hacker offers to fix the email issue immediately.
Execution
5 techniques
Execution
SNOWBELT maintained persistence through a Windows Startup folder shortcut, two scheduled tasks, and a headless Microsoft Edge process silently loading the extension.
The extension executes on a headless Microsoft Edge instance, so the victim doesn’t notice anything, while scheduled tasks and a startup folder shortcut are also created for persistence.
The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance... SnowGlaze is a Python-based tunneler... Finally, SnowBasin is a Python bindshell...
Persistence
7 techniques
Persistence
SNOWBELT maintained persistence through a Windows Startup folder shortcut, two scheduled tasks, and a headless Microsoft Edge process silently loading the extension.
The extension executes on a headless Microsoft Edge instance, so the victim doesn’t notice anything, while scheduled tasks and a startup folder shortcut are also created for persistence.
SnowBelt functions as a backdoor that allows attackers to maintain access to corporate accounts and move through internal systems without repeated authentication.
The hacker sends a link to a fake “Mailbox Repair” utility or asks the victim to open remote access tools like Quick Assist. Either way, they install the SNOW malware suite.
The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance and installs a malicious Chromium browser extension called SnowBelt. | SnowBelt, a JavaScript-based backdoor delivered as a Chromium browser extension, gives the attacker an initial foothold and maintains persistence via the browser's extension registration system.
Privilege Escalation
5 techniques
Privilege Escalation
SNOWBELT maintained persistence through a Windows Startup folder shortcut, two scheduled tasks, and a headless Microsoft Edge process silently loading the extension.
The extension executes on a headless Microsoft Edge instance, so the victim doesn’t notice anything, while scheduled tasks and a startup folder shortcut are also created for persistence.
SnowBelt functions as a backdoor that allows attackers to maintain access to corporate accounts and move through internal systems without repeated authentication.
Stealth
3 techniques
Stealth
This directs victims to a landing page masquerading as a 'Mailbox Repair Utility'... SnowBelt... often hides behind names like 'MS Heartbeat' or 'System Heartbeat.'
Credential Access
2 techniques
Credential Access
Discovery
4 techniques
Discovery
Attacker commands (such as whoami or net user) are sent through the SnowGlaze tunnel...
After gaining initial access, process execution telemetry recorded UNC6692 using a Python script to scan the local network for ports 135, 445, and 3389.
Collection
1 technique
Collection
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious Chromium browser extension used as part of the SNOW malware suite to provide backdoor access and steal saved credentials and session cookies from the browser.
A malicious Chromium browser extension that provides backdoor access and steals saved credentials and session cookies.
A malicious browser extension/backdoor used to maintain access to corporate accounts and enable movement through internal systems without repeated authentication. It can also download additional malicious components.
A JavaScript-based backdoor delivered as a malicious Chromium browser extension. It establishes initial foothold, maintains persistence through browser extension registration, downloads additional Snow malware components, and proxies attacker commands to SnowBasin.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.