[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnwaI8Z7qVIwNMvUL1A17Pdc8oTQtb6h0pp8RDDTMbQw":3},{"article":4,"iocs":51,"watch_terms":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":35},"bbdc69dd-0686-4679-be84-22db24547d91","UNC6692 Combines Social Engineering, Malware, Cloud Abuse","unc6692-combines-social-engineering-malware-cloud-abuse-ae61f5","A newly discovered threat actor is using Microsoft Teams, AWS S3 buckets, and custom \"Snow\" malware in a multipronged campaign.","UNC6692, a newly discovered threat actor, is conducting a sophisticated campaign combining social engineering, custom malware named \"Snow,\" and cloud service abuse. The attacker leverages Microsoft Teams for initial contact and AWS S3 buckets for malware distribution and command-and-control operations. This multipronged approach demonstrates how threat actors are increasingly abusing legitimate cloud services to evade detection.","UNC6692 threat actor deploys Snow malware via Teams and AWS S3 in multi-stage campaign.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Func6692-social-engineering-malware-cloud-abuse","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltefbf4a39ab640f97\u002F69efb7451d99c5d0f25b7d66\u002Fsnowy_ski_resort_Marc_Muench_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-04-27T20:12:34+00:00","2026-04-27T22:00:11.123376+00:00",8,[18,21,24,27,29],{"name":19,"type":20},"UNC6692","threat_actor",{"name":22,"type":23},"Microsoft","vendor",{"name":25,"type":26},"Microsoft Teams","product",{"name":28,"type":23},"Amazon Web Services",{"name":30,"type":26},"AWS S3","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":11,"name":33,"slug":34},"Malware","malware",[36,41,46],{"category":37},{"id":38,"icon":11,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":11,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":11,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":34,"value":53,"context":54},"Snow","Custom malware deployed by UNC6692 in social engineering and cloud abuse campaign",[22,28,25]]