Loading story…
Google Threat Intelligence Group and Mandiant disclosed that a newly tracked threat cluster, UNC6692, breached enterprise networks by posing as IT help desk staff in Microsoft Teams after first overwhelming targets with high-volume spam emails. Victims were persuaded to accept chats from external Teams accounts and visit a fake "Mailbox Repair Utility" or "Mailbox Repair and Sync Utility" page, which harvested credentials with a double-entry trick that intentionally rejected the first password submissions before installing malware. The campaign relied on trusted cloud services including AWS S3 and Heroku for payload delivery, command-and-control, and exfiltration, allowing the activity to blend into normal enterprise traffic without exploiting a software vulnerability.
After initial access, UNC6692 deployed the modular SNOW malware suite, including SNOWBELT for browser-extension persistence and command relay, SNOWGLAZE for tunneling and proxying, and SNOWBASIN for remote command execution, screenshots, and file transfer, alongside AutoHotkey scripts and a portable Python environment. Investigators said the attackers scanned internal networks, used PsExec and RDP to pivot to a backup server, dumped LSASS memory, performed Pass-the-Hash against domain controllers, and used FTK Imager to steal NTDS.dit and registry hives before exfiltrating data through LimeWire. Google said the tradecraft resembles social-engineering operations associated with other criminal actors but found no confirmed overlap, and the campaign appears separate from other recently reported Teams-based help desk impersonation activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
In late December 2025, UNC6692 began a multistage social-engineering campaign using high-volume email bombing followed by Microsoft Teams messages impersonating IT help desk staff. Victims were lured to a fake "Mailbox Repair Utility" page that harvested credentials and initiated malware deployment.
Reporting on the campaign said defenders were provided with infrastructure indicators, file hashes, detection queries, and YARA rules tied to UNC6692 and the SNOW malware suite. These technical details were published to support detection and response efforts.
On April 23, 2026, Google Cloud published a detailed report describing how UNC6692 used SNOWBELT, SNOWGLAZE, and SNOWBASIN, along with AutoHotkey scripts and portable Python tooling, to maintain access and move laterally. The report also documented post-compromise actions including reconnaissance, credential theft, and domain controller access.
After initial access, UNC6692 conducted internal reconnaissance, used PsExec and RDP to pivot to a backup server, dumped LSASS memory, and performed Pass-the-Hash to reach domain controllers. The actor then used FTK Imager to extract NTDS.dit and registry hives and exfiltrated the stolen files via LimeWire.
Google Threat Intelligence Group and Mandiant disclosed on April 22, 2026 that they had identified the previously undocumented threat cluster UNC6692. The disclosure described the Teams impersonation tradecraft, the SNOW malware ecosystem, and the campaign's use of legitimate cloud services for delivery, command-and-control, and exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
11 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcetherecord.media
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcecommunity.gurucul.com
Open sourceinfosec.pub
Open sourcethehackernews.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 29, 2026
A social-engineering campaign targeting employees at **financial and healthcare** organizations is abusing **Microsoft Teams** chats/calls to trick users into granting remote access via *Windows Quick Assist*, enabling deployment of a newly identified malware family dubbed **A0Backdoor**. The activity begins with **email bombing** (flooding inboxes with spam) followed by an attacker impersonating internal IT over Teams, offering help and then persuading the victim to start a Quick Assist session; the tradecraft overlaps with tactics previously attributed to **Blitz Brigantine / Storm-1811**, which Microsoft has linked to **Black Basta**-associated operations. Post-access, the actor deploys **digitally signed MSI installers** masquerading as Teams-related components and *CrossDeviceService* (associated with Windows *Phone Link*), sometimes delivered via **tokenized links** from Microsoft personal cloud storage to appear trustworthy and hinder collection. BlueVoyant reported the installers drop files into user `AppData` paths that mimic legitimate Microsoft locations and use **DLL sideloading** (e.g., a malicious `hostfxr.dll`) to execute an in-memory loader that decrypts shellcode, performs sandbox checks, and ultimately extracts and runs **A0Backdoor** (using **AES**-encrypted payloads and a **SHA-256**-derived key), with anti-analysis behavior including excessive thread creation intended to disrupt debugging.
Jun 29, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026