UNC6692 Combines Social Engineering, Malware, Cloud Abuse

Summary

UNC6692, a newly discovered threat actor, is conducting a sophisticated campaign combining social engineering, custom malware named "Snow," and cloud service abuse. The attacker leverages Microsoft Teams for initial contact and AWS S3 buckets for malware distribution and command-and-control operations. This multipronged approach demonstrates how threat actors are increasingly abusing legitimate cloud services to evade detection.

Indicators of Compromise

• malware — Snow

Entities