Threat actor uses Microsoft Teams to deploy new “Snow” malware
A threat group known as UNC6692 employs social engineering to spread a brand-new, unique malware suite called "Snow," which consists of a backdoor, a tunneler, and a browser extension.
Their objective is to steal confidential information following a deep network breach via domain takeover and credential theft.
Google's Mandiant researchers claim that after creating a sense of urgency through "email bombing," the attacker contacts targets via Microsoft Teams while pretending to be an IT helpdesk representative.
This strategy, which deceives users into giving attackers remote access via Quick Assist or other remote access tools, is becoming more and more common in the cybercrime area, according to a recent Microsoft analysis.
The victim of UNC6692 is asked to visit a link in ord...