Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknownAdvanced sophistication

UNC6692

UNC6692 is a threat actor group, tracked by Brandefense. It uses 11 MITRE ATT&CK techniques.

Request IOC feedRequest ATT&CK export
Techniques
11
Exploited CVEs
No CVE data
Record updated

About UNC6692.

UNC6692 is a threat actor that employs social engineering tactics, such as impersonating IT helpdesk personnel, to gain initial access to victim environments. They utilize a custom modular malware suite, including components like SNOWBELT, SNOWGLAZE, and SNOWBASIN, to facilitate deep network penetration and lateral movement. After extracting credentials from the LSASS process memory, they leverage Pass-The-Hash techniques to authenticate to domain controllers and exfiltrate sensitive data using LimeWire. The campaign highlights the systematic abuse of legitimate cloud services for payload delivery and command-and-control infrastructure.

Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.