Hackers Leverage Microsoft Teams to Breach Organizations Posing as IT Helpdesk Staff

UNC6692 executed a sophisticated multistage intrusion campaign that leveraged Microsoft Teams impersonation and AWS-hosted phishing pages to deliver a modular malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN). The attackers harvested credentials, established C2 via Heroku and S3, tunneled traffic, performed lateral movement with PsExec and RDP, dumped LSASS to obtain hashes, used Pass-the-Hash to access domain controllers, and exfiltrated NTDS.dit and registry hives; the report includes IoCs and recommended mitigations.