Introduction
In late December 2025, the Google Threat Intelligence Group (GTIG) uncovered a sophisticated multi-stage intrusion campaign orchestrated by a newly tracked threat actor, UNC6692. This group leveraged persistent social engineering, a custom modular malware suite, and adept lateral movement to achieve deep network penetration. Their primary tactic involved impersonating IT helpdesk staff to trick victims into accepting Microsoft Teams invitations from external accounts and installing malicious tools. Understanding their attack chain is crucial for defenders to build effective countermeasures. This guide breaks down the attack into actionable steps, highlighting detection and prevention strategies at each stage.
What You Need
- Access to Microsoft Teams and email logs
- Endpoint Detection and Response (EDR) tools (e.g., CrowdStrike, SentinelOne)
- Browser extension management policies (Chrome, Edge)
- Windows Startup folder and Scheduled Task monitoring
- Knowledge of AutoHotkey execution and scripting
- Network traffic analysis capabilities (e.g., AWS S3 bucket monitoring)
- User awareness training materials for social engineering
Step-by-Step Guide to Understanding and Defending Against UNC6692
Step 1: Recognize the Initial Email Overwhelm Campaign
UNC6692 began by flooding the target’s inbox with a large volume of emails to create urgency and distraction. This psychological tactic aimed to make the victim more receptive to subsequent helpdesk outreach. Defense: Monitor for unusual email volume spikes from external sources. Implement email throttling and anomaly detection rules. Train users to recognize mass email campaigns as a precursor to phishing.
Step 2: Identify the Teams-Based Social Engineering Attempt
Following the email barrage, the attacker sent a Microsoft Teams chat request posing as helpdesk personnel, offering to fix the email issue. The message contained a link to “install a local patch” against spamming. Defense: Configure Teams to block external chat invitations by default. Educate users to verify helpdesk contacts through official channels before clicking links. Enable logging of Teams interactions for forensic analysis.
Step 3: Analyze the Malicious Download Chain
When the victim clicked the link, the browser loaded an HTML page from a threat actor-controlled AWS S3 bucket (e.g., service-page-25144-30466-outlook.s3.us-west-2.amazonaws.com/update.html). This page hosted a renamed AutoHotkey binary and a script file with the same name. AutoHotkey automatically executes the script if the binary and script share a name in the same directory. Defense: Block downloads from untrusted S3 buckets. Use web filtering to block known malicious domains. Monitor for AutoHotkey execution (ahk.exe) in unusual contexts.
Step 4: Detect the Initial Reconnaissance Commands
Upon execution, the AutoHotkey script ran reconnaissance commands to gather system information. Defense: Deploy EDR to detect suspicious command-line activity from AutoHotkey. Look for processes spawning cmd.exe or powershell.exe from AutoHotkey with enumeration flags.
Step 5: Identify Installation of the SNOWBELT Malicious Browser Extension
UNC6692 installed a custom Chromium browser extension called SNOWBELT (not from the Chrome Web Store). This extension persisted via a shortcut in the Windows Startup folder and a Scheduled Task. The script checked for the extension and, if missing, ran a command to launch msedge.exe with a custom --load-extension flag pointing to a local directory. Defense: Monitor for new browser extensions loaded via command-line flags (--load-extension). Block unsigned extensions. Audit Startup folder changes and Scheduled Tasks creation. Use application whitelisting for browser executables.
Step 6: Harden Against Custom Malware Persistence
The attacker’s modular malware suite includes persistence mechanisms. The AutoHotkey script checked whether an Edge browser process was already running with the extension (via CheckHeadlessEdge() function). If not, it created a Scheduled Task to re-launch the browser in headless mode. Defense: Disable unnecessary headless browser modes. Monitor for --headless flags in browser processes. Restrict access to the Startup folder and Scheduled Tasks via Group Policy.
Tips for Strengthening Defenses
- User Education: Conduct regular phishing simulations that include Teams impersonation. Emphasize that real helpdesk staff never ask to install software via external chat links.
- Technical Controls: Implement conditional access policies to block external Teams invitations unless explicitly allowed. Use Microsoft Defender for Office 365 to flag suspicious email volumes.
- Monitoring: Set up alerts for AutoHotkey execution, especially when combined with download activities from cloud storage URLs.
- Browser Hardening: Enforce a policy that only allows extensions from trusted stores. Use Windows AppLocker or WDAC to block unsigned executables.
- Incident Response: If SNOWBELT is detected, isolate the endpoint, collect the extension folder and AutoHotkey scripts for analysis, and check for lateral movement.
- Log Retention: Retain Teams chat logs and AWS S3 access logs for at least 90 days to enable forensic reconstruction of the attack chain.
By following these steps, organizations can better detect and mitigate the tactics employed by UNC6692 and similar threat actors who combine social engineering with custom malware.