MalwarePublished 27 Apr 2026

UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware

Source SecurityWeek

Description

The threat actor infected victims with the Snow malware family – Snowbelt, Snowglaze, and Snowbasin – for persistent access. The post UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware appeared first on SecurityWeek .

Impact

The threat actor gains persistent access to victim environments, enabling credential harvesting, lateral movement, privilege escalation, and sensitive data exfiltration including Active Directory databases and user credentials. The use of trusted cloud services for hosting malware components helps evade traditional network defenses. The campaign can compromise internal network security and potentially lead to further exploitation or data breaches. No direct evidence of widespread exploitation or zero-day vulnerabilities is reported.

Defensive guidance

Organizations should be aware of the social engineering tactics used, including email bombing and impersonation of IT support, and educate users accordingly. Monitoring for unusual scheduled tasks, unauthorized browser extensions, and suspicious network tunnels may help detect infection.

References

securityweek.com/unc6692-uses-email-bombing-social-engineering-to-deploy-snow-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Apr 2026, 10:45 UTC

References

Community reviews