Hackers Exploit Microsoft Teams to Breach Organizations While Posing as IT Helpdesk Staff

UNC6692 is conducting targeted enterprise intrusions by abusing Microsoft Teams social engineering to trick users into a fake Mailbox Repair Utility that captures credentials, then deploying a modular malware suite called 'SNOW' (SNOWBELT, SNOWGLAZE, SNOWBASIN) to maintain persistence, create encrypted tunnels, execute commands, dump LSASS for credential theft, perform Pass-the-Hash attacks against domain controllers, and exfiltrate Active Directory and other data to attacker-controlled cloud endpoints; multiple IoCs are provided for detection.