UNC6692 employs a multi-stage attack starting with email bombing and social engineering to lure victims into executing malicious code via a fake mailbox repair phishing page. This leads to the installation of the Snow malware family: Snowbelt (a Chromium extension backdoor), Snowglaze (a Python-based tunneler for secure C2 communication and lateral movement), and Snowbasin (a persistent local HTTP backdoor). The malware facilitates credential harvesting through fake authentication prompts and enables lateral movement using tools like PsExec and RDP sessions. UNC6692 extracts sensitive credentials and Active Directory data by dumping LSASS memory and SAM/registry hives, exfiltrating data via LimeWire. The campaign uses cloud-hosted infrastructure (AWS S3) to evade detection. The attack chain demonstrates a blend of social engineering and technical evasion to maintain persistent access and conduct reconnaissance within victim networks.

The threat actor gains persistent access to victim environments, enabling credential harvesting, lateral movement, privilege escalation, and sensitive data exfiltration including Active Directory databases and user credentials. The use of trusted cloud services for hosting malware components helps evade traditional network defenses. The campaign can compromise internal network security and potentially lead to further exploitation or data breaches. No direct evidence of widespread exploitation or zero-day vulnerabilities is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should be aware of the social engineering tactics used, including email bombing and impersonation of IT support, and educate users accordingly. Monitoring for unusual scheduled tasks, unauthorized browser extensions, and suspicious network tunnels may help detect infection. Since no official fix or patch is indicated, defensive measures should focus on user awareness and detection of the described malware behaviors.