INTEL_REPORT
Mandiant / Google Threat Intelligence Blog · published 4/23/2026, 2:00:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrus…
https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware
sha256:b2465f39a5765f1198619517549fa0152f561714612593d8b7ce351815d7b2e9
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| coreuicomponents.dll |
| Open → |
| domain | shell32.dll | Open → |
| domain | lsass.exe | Open → |
| domain | ntds.dit | Open → |
| domain | service-page-18968-2419-outlook.s3.us-west-2.amazonaws.com | Open → |
| domain | protected.ahk | Open → |
| domain | profileb5.txt | Open → |
| domain | regsrvc.exe | Open → |
| domain | helper.html | Open → |
| domain | cmd.exe | Open → |
| domain | powershell.exe | Open → |
| domain | s3.us-east-2.amazonaws.com | Open → |
| domain | chrome.runtime.connectnative | Open → |
| domain | dream.html | Open → |
| domain | chrome.downloads | Open → |
| domain | chrome.downloads.onchanged | Open → |
| domain | os.chdir | Open → |
| domain | sad4w7h913-b4a57f9c36eb.herokuapp.com | Open → |
| domain | example.com | Open → |
| domain | cloudfront-021.s3.us-west-2.amazonaws.com | Open → |
| domain | service-page-11369-28315-outlook.s3.us-west-2.amazonaws.com | Open → |
| domain | reader.read | Open → |
| domain | self.path | Open → |
| domain | self.wfile.write | Open → |
| domain | socketserver.threadingmixin | Open → |
| url | https://service-page-25144-30466-outlook.s3.us-west-2.amazonaws.com/update.html?email=<redacted>.com | Open → |
| sha256 | 691f7258f212fa8908a8bf06bcf9e027d2177276e13e10ff56bd434ff3755cc4 | Open → |
| sha256 | 2fa987b9ed6ec6d09c7451abd994249dfaba1c5a7da1c22b8407c461e62f7e49 | Open → |
| sha256 | c8940de8cb917abe158a826a1d08f1083af517351d01642e6c7f324d0bba1eb8 | Open → |
| sha256 | 7f1d71e1e079f3244a69205588d504ed830d4c473747bb1b5c520634cc5a2477 | Open → |
| sha256 | ca390b86793922555c84abc3b34406da2899382c617f9dcf83a74ac09dd18190 | Open → |
| sha256 | 6e6dab993f99505646051d2772701e3c4740096ff9be63c92713bcb7fcddf9f7 | Open → |
| sha256 | de200b79ad2bd9db37baeba5e4d183498d450494c71c8929433681e848c3807f | Open → |