Summary Points
- A new threat group, UNC6692, employs a sophisticated attack chain involving social engineering, custom malware, and abuse of legitimate cloud infrastructure, specifically AWS S3 buckets.
- The attacker uses multi-stage tactics, including phishing via email and Teams, malicious AutoHotkey scripts, and a custom Chrome extension (Snowbelt) for remote command execution.
- They extensively conduct lateral movement, credential theft, and network reconnaissance, culminating in extracting sensitive data and furthering access through pass-the-hash techniques.
- Defenders must enhance visibility into browser activity, cloud traffic, and cross-platform events as attackers utilize legitimate cloud services to evade traditional detection methods.
New Attack Tactics Use Social Tricks, Malware, and Cloud Infrastructure
A new hacker group, called UNC6692, is using clever methods to target computers and data. They combine social engineering, malware, and cloud abuse. Social engineering tricks people into clicking harmful links. The hackers also use cloud services like Amazon Web Services (AWS) to hide their activities. This makes it harder for security teams to detect their presence. The attack aims to steal credentials and access sensitive information. Experts say this approach is practical because it uses familiar tools in new ways. As this method spreads, more organizations may need to upgrade their security measures to stay safe and protect the human journey in technology.
How UNC6692 Carries Out the Attack Chain
The attack begins when the hackers flood a target’s email inbox with messages. They then contact the victim via Microsoft Teams, pretending to be help desk staff. They send a link that, when clicked, downloads malicious files. These files include a script and malware called AutoHotkey, which run automatically. This allows the hackers to gain access and install more harmful tools. Using these tools, they scan the network for passwords and accounts. They then use stolen credentials to move deeper into the system. The hackers even access backup servers and extract sensitive information. They also use powerful techniques called “pass-the-hash” to control entire networks. Each step shows how cybercriminals use technology creatively to achieve their goals, making defenses more challenging.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
CyberRisk-V1
