Hackers Pretend to Be IT Support on Teams: Here's How They Stole a Company's Data Without Breaching Anything
Summary
Researchers from Google Mandiant documented a new campaign conducted by the group UNC6692, which exploits Microsoft Teams as an initial access vector to deploy a modular malware suite called Snow. The attack does not leverage any software vulnerabilities but relies entirely on social engineering techniques, with an effectiveness that allowed the attackers to reach the corporate domain controllers and exfiltrate the entire Active Directory database.
Email Bombing and Fake Helpdesk
The sequence begins with an email bombing action: the victim's inbox is flooded with spam messages to create a sense of immediate urgency. At that point, the attacker contacts the target on Microsoft Teams, pretending to be an internal IT support agent. The pretext is the classic emergency ticket: to install a patch that would block the flow of unwanted messages. In reality, the victim downloads a dropper that runs AutoHotkey scripts to load SNOWBELT, a malicious Chrome extension.
The most insidious element is that SNOWBELT runs on a headless instance of Microsoft Edge, so the victim does not see any open windows. The malware does not stop there: to ensure long-term persistence, it creates scheduled tasks and a shortcut in the system's startup folder, ensuring survival through a machine reboot without operator intervention.
The Snow Suite: Three Coordinated Components
SNOWBELT is not just a persistence mechanism but also the relay through which operator commands reach the rest of the chain. Commands travel via SNOWGLAZE, a tunneler that establishes an authenticated WebSocket connection to the C2 infrastructure to mask communications. SNOWGLAZE also supports SOCKS proxy operations, allowing arbitrary TCP traffic to be routed through the compromised host, effectively using it as a network pivot.
The commands are then received by SNOWBASIN, a backdoor written in Python that exposes a local HTTP server on ports 8000-8002. From here, CMD or PowerShell commands are executed, screenshots are captured, files are downloaded and deleted, with results sent back to the operator through the same pipeline. SNOWBASIN also supports a self-termination command, useful for vanishing the backdoor at the end of the operation or in the event of imminent detection.
The modular structure of the suite is deliberate: each component performs a specific and separate function, making the overall detection more difficult even when one of the pieces is identified. SNOWBELT handles communication with the C2 via browser, SNOWGLAZE offers encrypted channel and network proxying, while SNOWBASIN is tasked with "getting its hands dirty" to execute commands and tasks on the operating system.
Post-compromise: The Path to Domain Controllers
Once a presence was established in the targeted corporate network, UNC6692 conducted internal reconnaissance by scanning SMB and RDP services to identify reachable hosts and high-value targets on the network. The attackers then dumped the LSASS memory to extract credential material in clear text and NTLM hashes, which they exploited with pass-the-hash techniques to authenticate to additional hosts without needing the original passwords.
Lateral movement followed a progressive path to the domain controllers. In the final phase, the group employed FTK Imager, a legitimate forensic imaging tool, to extract the Active Directory database along with the SYSTEM, SAM, and SECURITY registry hives. The exfiltration of these files occurred via LimeWire, taking the entire domain credential set out of the corporate networks: an access that, once obtained offline, allows the retrieval of hashes for practically all domain accounts, including privileged accounts.
Teams as a Consolidated Attack Vector
The UNC6692 campaign is not an isolated incident and fits into a well-documented trend. In mid-April, Microsoft itself published a separate report warning that threat actors are improperly exploiting, and increasingly frequently, Teams' external collaboration features to impersonate IT support figures. The pattern described by Microsoft is identical and involves cross-tenant chats, the use of remote access tools such as Quick Assist, and lateral movement capabilities via WinRM.
The difference with UNC6692 lies in the weaponry: instead of relying on already available commercial tools, the group developed a dedicated custom suite, signaling a significant level of operational investment. ReliaQuest reported that 56% of phishing activity on Teams attributed to former affiliates of Black Basta was concentrated in the first four months of 2026, peaking at 32% in March. This data suggests that the Teams channel, perceived as "safe" by business users compared to email, has now become a mature attack vector systematically exploited by multiple groups. CSOOnline emphasizes that real-time communication on these tools makes impersonation of IT staff more convincing compared to traditional email phishing because the target expects quick responses and has less time to verify the identity of the interlocutor.
The Mandiant report provides security teams with indicators of compromise (IoC) and specific YARA rules to detect the Snow suite within corporate networks. Among the operational suggestions: enforce independent verification policies for any remote access requests received via Teams, limit external collaboration to verified accounts, and monitor anomalous AutoHotkey activity, especially in combination with Edge processes in headless mode.