Threat actor uses Microsoft Teams to deploy new “Snow” malware

UNC6692 conducted a targeted campaign using Microsoft Teams social-engineering to trick victims into installing a dropper that deploys the “Snow” toolset—SnowBelt (browser extension/persistence), SnowGlaze (WebSocket/SOCKS tunneler), and SnowBasin (Python backdoor). The actors performed internal reconnaissance, credential theft (LSASS dumps, pass-the-hash), lateral movement to domain controllers, and exfiltrated AD and registry hives, with Mandiant providing IoCs and YARA rules for detection.