SNOW Malware Ecosystem Uses Teams Phishing, WebSocket Tunnels, and Browser Extensions

Threat actors are increasingly chaining classic phishing with collaboration platforms and covert tunneling to create highly believable intrusion paths.

A recent multi-stage campaign attributed to UNC6692 exposes how adversaries combine email bombardment, Microsoft Teams impersonation, malicious browser extensions, WebSocket tunnels, and Python backdoors into a single, resilient ecosystem known as SNOW.

The campaign began with an email-bombing disruption designed to create operational friction and user fatigue. While inboxes flooded, UNC6692 contacted targets over Microsoft Teams posing as IT helpdesk staff and offered a “Mailbox Repair and Sync Utility” link.

The shift from email to an enterprise collaboration channel lowered suspicion: employees naturally trust helpdesk requests in-platform, and repeated prompts on a fake authentication page ensured accurate credential harvesting.

Stolen credentials were exfiltrated to actor-controlled AWS S3 storage, illustrating a simple but effective credential-harvest-and-stage approach that blends web-based credential theft with cloud-hosted staging.

Following credential theft, the attack deployed an AutoHotkey binary and script from AWS S3. The script silently installed SNOWBELT, a malicious Chromium browser extension masquerading as a system heartbeat tool.

ExtraHop Researchers said that, the operation demonstrates why defenders must look beyond single-channel protections and assume attackers will exploit trusted enterprise workflows.

SNOW Malware Ecosystem

SNOWBELT functioned as the initial persistent foothold, using JavaScript and browser-native features (service workers and keep-alive tab behaviors) to remain active while also downloading additional components.

It placed a shim inside the browser extension system and ensured continuous execution by coupling browser persistence with operating-system persistence.

AutoHotkey shortcuts in the Windows Startup folder and scheduled tasks launched a hidden Edge process running SNOWBELT, while active security logs were routinely cleared to reduce forensic visibility.

Once staged, the SNOW ecosystem expanded laterally. SNOWGLAZE, a Python-based tunneling utility, established WebSocket tunnels to actor-controlled C2 hosted on legitimate cloud platforms.

By using WebSockets and SOCKS proxying, SNOWGLAZE concealed C2 traffic as regular web communications and enabled tunneled RDP and PsExec sessions back into the enterprise.

This approach allowed actors to pivot from the compromised host to internal assets while obscuring origin and protocol signatures that traditional perimeter tools often flag.

The final execution layer, SNOWBASIN, ran as a local HTTP server on the host and executed commands via cmd.exe and PowerShell, captured screenshots, and exfiltrated files.

Using SNOWGLAZE-facilitated access, the operators performed targeted port scans and located backup servers and domain-connected resources.

They used harvested admin credentials and PsExec/RDP over the tunnel to access a backup server, dumped LSASS memory to capture NTLM hashes and Kerberos tickets, and executed pass-the-hash techniques to pivot to the domain controller.

By running legitimate forensic tools (FTK Imager) on the DC, UNC6692 bypassed file locks and exported NTDS.dit and other sensitive hives, which were then exfiltrated via atypical channels.

This campaign encapsulates several high-confidence trends flagged by industry reporting: Unit 42’s 2025 Global Incident Report showed 45% of social engineering attacks relied on internal impersonation to build trust, and the 2026 Verizon DBIR confirmed growing success rates for helpdesk-style impersonation.

Defenders should treat multi-channel social engineering as an integrated threat: harden collaboration platforms with MFA and verified app policies, monitor browser extension installations and Service Worker activity, inspect WebSocket and cloud-hosted service traffic for tunneling patterns.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide