🎯Basically, a hacker group tricks people using Microsoft Teams to install harmful software that steals information.
What Happened
A threat group known as UNC6692 has developed a new malware suite named Snow, which they deploy using social engineering tactics via Microsoft Teams. This malware includes a browser extension, a tunneler, and a backdoor, all aimed at stealing sensitive data after compromising networks through credential theft and domain takeover.
How It Works
The attackers employ email bombing tactics to create a sense of urgency among their targets. They contact victims through Microsoft Teams, posing as IT helpdesk agents. Victims are tricked into clicking a link that appears to be a patch to block email spam. Instead, they download a dropper that executes AutoHotkey scripts to load the malicious Chrome extension known as SnowBelt.
The SnowBelt extension operates silently on a headless instance of Microsoft Edge, creating scheduled tasks and shortcuts for persistence. It serves as a relay for commands sent to a Python-based backdoor called SnowBasin. This setup allows attackers to execute commands remotely, exfiltrate data, and manage files on the infected system.
Who's Being Targeted
The primary targets of this attack are organizations that utilize Microsoft Teams for communication. The attackers conduct internal reconnaissance to identify additional targets within the network, including services like SMB and RDP.
Signs of Infection
Organizations should be aware of unusual activities such as:
Unexpected prompts for
Unrecognized browser extensions
Increased network traffic
How to Protect Yourself
To mitigate the risk of infection from the Snow malware:
Detection
- 1.Educate employees about social engineering tactics and phishing attempts.
- 2.Implement robust email filtering to reduce spam and phishing emails.
Removal
What to Watch
Mandiant has provided extensive indicators of compromise (IoCs) and YARA rules to help organizations detect the Snow malware suite. As the threat landscape evolves, vigilance and proactive measures are essential to safeguard sensitive data from similar attacks.
🔒 Pro insight: The use of Microsoft Teams for malware distribution highlights a growing trend in leveraging trusted platforms for social engineering attacks.
