TLDR Tech / InfoSec
Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
UNC6692 ran a staged intrusion starting with heavy email spam and Microsoft Teams phishing, luring victims into installing a fake “Mailbox Repair Utility” delivered via a malicious Edge-only landing page that harvests credentials and drops AutoHotKey-based loaders. The operation installed the SNOWBELT browser extension plus SNOWGLAZE and SNOWBASIN Python components to maintain a WebSocket tunnel, run a local bindshell, move laterally with PsExec and RDP, and exfiltrate data through S3- and Heroku-hosted C2 infrastructure, all mapped to concrete IOCs and ATT&CK techniques for defenders.
Read the full story