UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

Mandiant and other vendors observed UNC6692 using Microsoft Teams helpdesk impersonation combined with an email-bombing campaign to socially engineer primarily senior executives into installing a malicious payload via a phishing page that downloads AutoHotkey scripts and a malicious Edge extension (SNOWBELT); this deploys a modular toolkit including SNOWGLAZE (Python tunneler) and SNOWBASIN (persistent backdoor) enabling lateral movement, credential theft (Pass‑The‑Hash), remote execution, and exfiltration while abusing cloud services for payload delivery and C2.