UNC6692 carried out a multi-stage intrusion that started with a phishing link sent through Microsoft Teams, delivered a malicious AutoHotKey payload, and deployed a custom modular malware toolkit known as SNOW, including SNOWBELT, SNOWGLAZE, and SNOWBASIN. The operation also used a rogue Chromium browser extension, a Python-based tunneling utility, and a local HTTP backdoor to enable lateral movement, credential theft, and data exfiltration through cloud services. The campaign stood out for its effective abuse of legitimate cloud infrastructure and browser-based persistence mechanisms. Detecting this activity requires close monitoring of unusual browser extension behavior, scheduled tasks that launch Edge in headless mode, and suspicious access to cloud storage services.
Google Threat Intelligence Group uncovered the campaign through analysis of Teams chat records, captured AutoHotKey scripts, scheduled task configurations, and network traffic involving AWS S3 and a Heroku-hosted WebSocket server. Malware analysis exposed the SNOW malware family, its internal components, communication patterns, and the attackers’ use of PsExec together with credential-dumping tools. Investigators also confirmed the theft of LSASS memory and Active Directory database files, which were exfiltrated through LimeWire.
Defenders should apply strict allow-listing policies for browser extensions, monitor for Microsoft Edge launched with headless or extension-related flags, and block access to unapproved AWS S3 buckets and Heroku domains. Enforcing multi-factor authentication for privileged accounts and watching for PsExec execution and LSASS access can help limit credential theft and lateral movement. Scheduled tasks and startup shortcuts should also be reviewed regularly to identify unauthorized persistence.
If any SNOW component is detected, isolate the affected system immediately, terminate suspicious Edge and AutoHotKey processes, and collect memory for LSASS-related forensic analysis. Block the known command-and-control domains and IP addresses, remove malicious browser extensions, and rotate credentials for privileged accounts. A full network-wide sweep should then be performed to identify additional compromised hosts, along with a review of scheduled tasks and startup items for persistence.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands:
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
