How the SNOW Malware Suite Is Turning Microsoft Teams Into a Cyberattack Weapon
There's a new attack campaign making waves in cybersecurity circles—and it's particularly dangerous because it doesn't rely on technical exploits. It relies on trust.
Google's Threat Intelligence Group (GTIG) and Mandiant researchers have identified a sophisticated new threat actor called UNC6692, deploying a custom, modular malware framework they've named the SNOW suite. The attack is elegant, multi-stage, and specifically designed to bypass the security instincts of even cautious employees.
Here's how it works—and why every business leader needs to know about it.
The Attack: Step by Step
Step 1: The Email Flood
The attack begins with what's known as email bombing. The target's inbox is suddenly overwhelmed with hundreds—sometimes thousands—of emails. The goal isn't the emails themselves. The goal is chaos. The victim is confused, distracted, and desperately looking for help.
Step 2: The Fake Helpdesk Call
Almost immediately, the victim receives a Microsoft Teams message from someone posing as an IT helpdesk employee. The message is reassuring: "We've detected unusual activity on your account. We're here to help."
This is the social engineering hook. The attacker exploits the victim's urgency and their inherent trust in IT support personnel. Because the message arrives via Microsoft Teams—a platform employees use every day—it appears completely legitimate.
Step 3: The Fake Repair Tool
The "helpdesk" directs the victim to click a link for a fake mailbox repair utility. The page is convincing. It checks that the victim is using Microsoft Edge. It presents a professional-looking interface. It displays a fake authentication prompt and a fake progress bar—all designed to look exactly like a legitimate enterprise tool.
While the victim watches the fake progress bar, the real attack is underway in the background.
Step 4: SNOW Is Deployed
Behind the scenes, the page silently downloads AutoHotKey scripts and deploys the first component of the SNOW malware suite: SNOWBELT—a JavaScript-based backdoor that installs itself as a malicious browser extension.
From there, SNOWBELT downloads two additional components:
- SNOWGLAZE — A Python-based tunneler that creates a covert communication channel back to the attacker's infrastructure, including abuse of AWS S3 buckets as command-and-control relay points
- SNOWBASIN — A Python-based bindshell that gives the attacker persistent, remote command execution access to the victim's machine
The attacker now has deep, persistent access to the network—and the victim has no idea.
Why This Attack Is So Dangerous for SMBs
Most cybersecurity awareness training focuses on email phishing—don't click suspicious links, don't open strange attachments. The SNOW attack bypasses all of that because:
- It uses a trusted platform. Microsoft Teams is not your email inbox. Employees instinctively trust it more.
- It creates urgency before the attack begins. The email flood ensures the victim wants help—making them far more likely to comply.
- It looks exactly like legitimate IT support. There are no obvious red flags. No Nigerian prince emails. No misspelled words. A convincing interface, a convincing persona, and a convincing workflow.
- SMBs often lack in-house IT staff who would recognize the deception. Without dedicated security expertise watching for anomalies, these attacks frequently go undetected until significant damage is done.
The Bottom Line for Business Owners
This is not a hypothetical threat. Google's Mandiant team documented this campaign in April 2026, and security researchers across the industry are raising alarms. The SNOW malware suite represents a new generation of attacks—technically sophisticated, socially engineered, and specifically designed to defeat conventional defenses.
The questions every business leader should be asking right now:
- Does my team know what to do if they suddenly receive hundreds of emails and then get a Teams message from "IT support"?
- Is my Microsoft Teams environment configured to flag or block messages from external, unverified accounts?
- Do I have endpoint detection tools capable of identifying malicious browser extensions and unusual PowerShell or AutoHotKey activity?
- Is my IT provider actively monitoring for these threats—or simply reacting after damage is done?
How CelereTech Protects Against Attacks Like SNOW
At CelereTech, our managed security approach is built for exactly this threat environment:
✅ Microsoft 365 Security Hardening — Including Teams external access controls and message policy configuration
✅ Endpoint Detection & Response (EDR) — Tools that detect unusual script execution, browser extension installations, and abnormal outbound connections
✅ Security Awareness Training — Your team learns to recognize social engineering before it succeeds
✅ 24/7 Threat Monitoring — We're watching your environment around the clock, not waiting for a help desk ticket
The SNOW malware suite is sophisticated. But it's not unstoppable—if you have the right protections in place.
Don't wait for the email flood to start.
📩 Connect with CelereTech to learn how we protect businesses like yours from the latest threat campaigns.
For a more in-depth discussion of this topic check out our blog post to dig deeper.
References:
- Google Threat Intelligence Group / Mandiant — "Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite" (April 23, 2026): https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware
- SecurityWeek — "UNC6692 Uses Email Bombing, Social Engineering to Deploy 'Snow' Malware" (April 27, 2026): https://www.securityweek.com/unc6692-uses-email-bombing-social-engineering-to-deploy-snow-malware/
- Dark Reading — "UNC6692 Combines Social Engineering, Malware, Cloud Abuse" (April 27, 2026): https://www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse
- The Hacker News — "UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware" (April 23, 2026): https://thehackernews.com/2026/04/unc6692-impersonates-it-helpdesk-via.html
- HivePro Threat Advisory — "UNC6692 Social Engineering Campaign Deploying SNOW Malware Suite": https://hivepro.com/threat-advisory/unc6692-social-engineering-campaign-deploying-snow-malware-suite/
Comments