UNC6692 Combines Social Engineering, Malware, Cloud Abuse

Google Threat Intelligence Group and Mandiant reported on UNC6692, a newly tracked financially motivated threat actor that executed a multistage intrusion campaign combining targeted social engineering via Microsoft Teams, abuse of AWS S3 for payload/C2, and custom tooling (AutoHotkey payloads, SNOWBELT browser extension, Snowglaze/Snowbasin Python components). The actor performed reconnaissance, credential theft (LSASS memory extraction and pass-the-hash) and lateral movement to the domain controller; Google published IOCs and YARA rules and urged defenders to monitor browser activity and cloud egress alongside traditional process monitoring.