UNC6692 Uses MS Teams and Cloud Reputations to Hijack Active Directory

A Google Threat Intelligence Group report details UNC6692’s sophisticated campaign that begins with an “email bomb” and Microsoft Teams helpdesk impersonation to capture credentials via a fake Mailbox Repair Utility, then deploys a coordinated SNOW malware ecosystem (SNOWBELT extension, SNOWGLAZE tunneler, SNOWBASIN bindshell) to establish persistence, tunnel traffic, move laterally (PsExec, RDP, Pass‑The‑Hash), and exfiltrate the Active Directory database while hosting components on trusted cloud platforms to evade detection.