UNC6692 Breach: Fake IT Helpdesk Exploits Microsoft Teams to Deploy Custom Malware Suite

By

Google Threat Intelligence Group (GTIG) has uncovered a sophisticated intrusion campaign by a newly tracked threat actor, UNC6692, that combines persistent social engineering, custom modular malware, and a malicious browser extension to achieve deep network access. The attack, which occurred in late December 2025, targeted a single victim through a carefully orchestrated sequence of email spam and phishing messages via Microsoft Teams.

According to GTIG analysts JP Glab, Tufail Ahmed, Josh Kelley, and Muhammad Umair, the attackers impersonated IT helpdesk personnel to gain the victim’s trust. “UNC6692 leveraged the inherent trust users place in enterprise software providers,” the analysts noted. “The campaign demonstrates a dangerous evolution in social engineering tactics, blending email overwhelm with Teams-based phishing and custom malware.”

Infection Chain

The attack began with a large email campaign designed to flood the victim’s inbox, creating urgency and distraction. Shortly after, the attacker contacted the victim via Microsoft Teams, posing as a helpdesk agent offering assistance. The victim was prompted to click a link to install a “local patch” to stop email spamming. That link led to an HTML page hosted on a threat actor-controlled AWS S3 bucket.

The HTML page downloaded a renamed AutoHotKey binary and a script file with the same name. Because AutoHotKey automatically executes a script if it shares the name with the binary, the malware ran without additional command-line arguments. The script executed initial reconnaissance commands and installed SNOWBELT, a malicious Chromium browser extension not available through the Chrome Web Store. Although Mandiant analysts could not recover the original AutoHotKey script, evidence of AutoHotKey execution was recorded immediately after the downloads.

Persistence Mechanisms

SNOWBELT established persistence through multiple methods. A shortcut to an AutoHotKey script was placed in the Windows Startup folder, which verified that SNOWBELT was running and that a scheduled task was present. The script then checked for the presence of a headless Edge browser process, and if not found, it ran a command to launch Edge with the malicious extension loaded. This allowed the malware to persist even after system reboots.

“The use of a headless browser to hide malicious activity is particularly concerning,” the GTIG analysts said. “It allows the threat actor to operate without raising suspicion from traditional endpoint monitoring.”

Background

Social engineering attacks targeting helpdesk personnel have become increasingly common, but UNC6692’s operation marks a notable escalation. By combining email spam with Teams-based impersonation and custom malware, the group exploited multiple layers of trust. The malware suite—including AutoHotKey scripts and the SNOWBELT extension—gave attackers deep network access and the ability to pivot within the victim’s environment undetected.

This campaign also highlights the dangers of allowing external Teams chat invitations without strict verification. The attacker’s account originated outside the victim’s organization, but the victim accepted the chat anyway, enabled by the urgency created by the email flood. GTIG investigators have shared indicators of compromise with the security community to help defenders update their detection rules.

What This Means

For enterprise security teams, this attack underscores the need for multi-factor authentication and user education on social engineering tactics. Employees should be trained to verify any unsolicited IT help desk contacts through a trusted channel, such as a phone call or ticketing system, before clicking any links. Additionally, organizations should consider restricting external Teams invitations not explicitly approved by IT.

The use of custom malware and browser extensions also points to the growing sophistication of threat actors. SNOWBELT’s ability to operate in a headless browser mode makes it harder to detect with conventional antivirus tools. “Organizations must adopt more advanced endpoint detection and response solutions,” the analysts advised. “They should also monitor for unusual AutoHotKey execution and browser extension installations outside official stores.”

As UNC6692 continues to refine its tactics, security teams are urged to stay vigilant and implement the following recommendations:

• Restrict external Teams chats to approved domains only.
• Monitor for AutoHotKey binaries downloaded from cloud storage services.
• Audit scheduled tasks and startup items for suspicious entries.
• Deploy browser extension policies that block sideloaded extensions.

For more details on the attack chain, refer to the Background section above. The full technical report is available from Google Threat Intelligence Group.

Related Articles

• A Practical Guide to Mitigating Iranian Cyber Threats: Phishing, Hacktivism, and Cybercrime
• Linux 'Copy Fail' Vulnerability Puts Major Distros at Risk: Privilege Escalation Exploit Published
• The Epic Saga of Multi-Stage Cyberattacks: Understanding, Detecting, and AI's Dual Role
• LofyGang Returns: Brazilian Hackers Target Minecraft Players with New 'LofyStealer' Malware
• Ransomware Crisis Hits Record High in 2025 Despite Decline in Profitability, Mandiant Warns
• CVE-2023-33538: Command Injection Attacks Target TP-Link Routers with Mirai Botnet Payloads
• How to Secure Your Linux System Against the Copy Fail Privilege Escalation Vulnerability
• Deep#Door Unveiled: A Comprehensive Guide to Detecting and Analyzing a Stealthy Python Backdoor