UNC6692

UNC6692 is a China-nexus threat cluster disclosed by Google's Threat Intelligence Group (Mandiant) on 23 April 2026. The cluster runs a sophisticated social-engineering campaign deploying the modular SNOW malware ecosystem through Microsoft Teams IT-support impersonation, targeting law firms, business process outsourcers (BPOs), and software-as-a-service providers — the same sector profile that BRICKSTORM/UNC5221 was sitting inside for 393 days undetected in Mandiant's M-Trends 2026 report.

UNC6692's attack flow begins with a large email campaign designed to overwhelm the target's inbox, then shifts to Teams, where attackers impersonate the target organisation's IT helpdesk. Targets are persuaded to download an AutoHotkey script that installs the three SNOW components: SNOWBELT (a malicious Chromium browser extension and JavaScript backdoor), SNOWGLAZE (a Python tunneller that creates WebSocket connections for SOCKS proxy and data exfiltration), and SNOWBASIN (a Python local HTTP server providing Remote Code Execution, file operations, and screenshots). Command-and-control uses AWS S3 and Heroku — the same cloud-service masking technique employed by BRICKSTORM, where legitimate cloud traffic makes malicious C2 indistinguishable from normal enterprise SaaS usage.

UNC6692 represents the evolution of social-engineering TTPs from email phishing to chat-based helpdesk impersonation, exploiting the trust employees extend to internal IT support channels. The Teams vector is specifically effective because most organisations have not applied the same scrutiny to Teams external-contact policies that they have to email. Lateral movement after initial access uses standard Windows credentials harvesting from LSASS and pass-the-hash to domain controllers. For UK law firms and BPOs already named as BRICKSTORM targets, UNC6692 extends the adversary surface to include credential theft via browser extension alongside the hypervisor-layer persistence Mandiant previously disclosed.