Sign up to save your podcasts
Or
Share UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware
A threat actor tracked as UNC6692 has been using email bombing combined with Microsoft Teams impersonation to trick victims into installing a sophisticated malware framework called Snow. The attackers overwhelm targets with emails, then pose as IT support offering a fake mailbox repair tool that actually deploys a browser-based backdoor, allowing them to harvest credentials, move laterally through networks, and steal Active Directory data. Google's Threat Intelligence Group warns that by hosting malicious components on trusted cloud platforms like AWS, the attackers can bypass traditional security filters and blend into legitimate traffic.
View all episodes
By DavidA threat actor tracked as UNC6692 has been using email bombing combined with Microsoft Teams impersonation to trick victims into installing a sophisticated malware framework called Snow. The attackers overwhelm targets with emails, then pose as IT support offering a fake mailbox repair tool that actually deploys a browser-based backdoor, allowing them to harvest credentials, move laterally through networks, and steal Active Directory data. Google's Threat Intelligence Group warns that by hosting malicious components on trusted cloud platforms like AWS, the attackers can bypass traditional security filters and blend into legitimate traffic.