Hackers Impersonate IT Helpdesk Staff to Breach Firms via Microsoft Teams

A newly identified cyber threat group, UNC6692, is using a clever mix of social engineering and custom malware to infiltrate corporate networks.

By impersonating IT helpdesk personnel on Microsoft Teams, these hackers trick employees into downloading a sophisticated malware suite that steals sensitive company data.

The Social Engineering Trap

The attack begins with an aggressive email bombing campaign. UNC6692 floods a target’s inbox with spam to create panic and distraction.

While the victim is overwhelmed, the attacker sends a Microsoft Teams message from an external account. Posing as IT support, the hacker offers a fake “local patch” to fix the spam problem.

When the victim clicks the provided link, they are taken to a fake “Mailbox Repair Utility” page. This highly convincing page forces the user into the Microsoft Edge browser and uses a calculated psychological trick.

It intentionally rejects the first password attempt to ensure the stolen credentials are entered correctly before sending them to an attacker-controlled Amazon server.

While the fake page uploads the stolen passwords, it displays a fake progress bar with messages like “Parsing configuration data”. This distraction keeps the victim engaged while the malware secretly downloads in the background.

According to Google, the initial payload includes an AutoHotkey script that runs automatically without alerting the user.

This script sets up scheduled tasks in Windows to ensure persistence and deploys a custom “SNOW” malware ecosystem. This toolset operates as a coordinated pipeline to control the infected system:

• SNOWBELT acts as a malicious Chromium browser extension to maintain a persistent backdoor connection.
• SNOWGLAZE functions as a Python network tunneler to create an encrypted bridge for external communication.
• SNOWBASIN provides a Python-based bindshell for interactive remote control, screenshot capture, and data extraction.

With a solid foothold, UNC6692 moves deeper into the targeted network. They use Python scripts to scan internal systems and gain access to backup servers.

From there, the attackers use the Windows Task Manager to extract memory from the LSASS process. This allows them to steal administrative password hashes and safely crack them outside the victim’s environment.

Using these stolen credentials, the hackers conduct a Pass-the-Hash attack to access the network’s domain controllers.

They open Microsoft Edge and download specialized forensics tools, such as FTK Imager, to quietly copy the entire Active Directory database. Finally, this massive trove of sensitive company data is exported out of the network using LimeWire.

This campaign highlights a growing “living off the cloud” strategy where hackers abuse trusted enterprise services to hide their tracks. Because they use legitimate platforms like Microsoft Teams and Amazon Web Services, traditional network reputation filters often fail.

Organizations must look beyond standard antivirus software and heavily enhance their browser monitoring.

IoC

Network Indicators

Indicator	Description
service-page-25144-30466-outlook.s3.us-west-2.amazonaws[.]com	Hosted the phishing site and initial AutoHotKey payloads
cloudfront-021.s3.us-west-2.amazonaws[.]com	SNOWBELT C2
wss://sad4w7h913-b4a57f9c36eb.herokuapp[.]com/ws	Hard-coded WebSocket Secure URL within SNOWGLAZE
service-page-11369-28315-outlook[.]s3[.]us-west-2[.]amazonaws[.]com	Domain for URL used to upload a text file

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.