JavaScript Required

Jumpseat Aerospace News requires JavaScript to function. Please enable JavaScript in your browser settings to continue.

UNC6692 Threat Actor Combines Social Engineering, Malware

April 27, 2026

2 min read

Key Takeaways

UNC6692 threat actor uses social engineering and custom malware.
Abuses legitimate cloud infrastructure like AWS S3 buckets.
Utilizes Microsoft Teams for phishing.
Installs malicious Chromium browser extension.

Silver membership required Upgrade to Silver to access Key Takeaways.

Upgrade

Strategic Implications

This campaign may indicate a growing trend of financially motivated threat actors leveraging cloud infrastructure and social engineering, which could pose significant challenges for defenders. The use of custom malware and legitimate cloud services suggests a high level of sophistication, which may signal a shift in the threat landscape.

Silver membership required Upgrade to Silver to access Strategic Implications.

Upgrade

What Happened

Newly Tracked Group Abuses Cloud Infrastructure And Custom Malware

A newly discovered threat actor, tracked as UNC6692, is using a combination of social engineering techniques, abuse of legitimate cloud infrastructure, and custom malware to conduct a multipronged campaign. The threat actor, which is believed to be financially motivated, has been observed using Microsoft Teams, AWS S3 buckets, and custom ‘Snow’ malware. According to a blog post by Google Threat Intelligence Group and Mandiant, the attack chain involves a multistage intrusion campaign, including the installation of a malicious Chromium browser extension and the use of a Python tunneler. This was first reported by Dark Reading.

Source

Companies Mentioned