How UNC6692's Teams Impersonation Attack Threatens Indian SMBs

The Attack That's Fooling Thousands

A previously undocumented threat group called UNC6692 has been systematically impersonating IT helpdesk employees through Microsoft Teams to trick employees into installing malware. Originally reported by The Hacker News, this attack represents a dangerous evolution in social engineering — one that exploits the trust we place in our own IT teams.

The attack is deceptively simple but devastatingly effective. UNC6692 creates fake Microsoft Teams accounts that closely mimic legitimate IT helpdesk staff. They then send Teams chat invitations to employees at target organizations, claiming to be from "IT Support" or "Help Desk." Once the employee accepts the invitation, the attacker guides them through a series of steps to download and execute a custom malware suite called SNOW. This malware establishes persistence, steals credentials, and opens backdoors for further compromise.

What makes this particularly concerning is the psychological element. Microsoft Teams is now synonymous with "work" for millions of Indian professionals. When someone claiming to be from IT support reaches out via Teams, most employees won't think twice — they'll trust it. In my years building enterprise systems, I've seen this pattern repeatedly: the best security controls often fail against the oldest attack vector — human trust.

Why This Matters for Indian Businesses

If you're running an SMB in India, this attack should concern you for several reasons:

First, the regulatory angle. India's Digital Personal Data Protection (DPDP) Act, 2023 requires organizations to implement reasonable security measures to protect personal data. If UNC6692 compromises your systems and exfiltrates customer data, you're not just facing operational damage — you're facing DPDP violations, potential penalties up to Rs 5 crore, and mandatory breach notifications to CERT-In within 6 hours of discovery.

Second, the targeting reality. UNC6692 doesn't discriminate by company size. While they may target large enterprises, the attack method — impersonation via Teams — works equally well against SMBs. In fact, SMBs are often easier targets because they have fewer security controls and less mature incident response capabilities.

Third, the supply chain risk. If you're a vendor or service provider to larger organizations, a compromise of your systems could trigger cascading regulatory consequences for your clients, damaging your reputation and contracts.

When I was architecting security for large enterprises, we always had dedicated security teams and 24/7 monitoring. Most Indian SMBs don't have that luxury. This is exactly why I built Bachao.AI — to make enterprise-grade threat detection and incident response accessible without requiring a full security team.

Technical Breakdown: How the Attack Works

Let me walk you through the exact attack sequence:

graph TD
    A[UNC6692 Reconnaissance] -->|Identifies target employees| B[Create Fake Teams Account]
    B -->|Mimics IT helpdesk branding| C[Send Teams Invitation]
    C -->|Employee accepts chat| D[Social Engineering Conversation]
    D -->|Tricks employee to download file| E[Malware Execution]
    E -->|SNOW malware installs| F[Credential Harvesting]
    F -->|Establish persistence| G[Lateral Movement]
    G -->|Exfiltrate data| H[Breach Complete]

The Impersonation Technique

UNC6692 doesn't hack Teams directly. Instead, they:

1. Create legitimate-looking Teams accounts using variations of real IT team member names (e.g., "IT_Support_Official" instead of "IT_Support")
2. Use generic IT support messaging that doesn't require deep knowledge of the target organization
3. Guide the victim through credential-stealing downloads, often disguised as security updates or software patches
4. Deploy SNOW malware, which is designed to:

Why SNOW is Dangerous

Unlike off-the-shelf malware, SNOW is custom-built for this threat group. This means:

1. Antivirus evasion: Standard antivirus signatures won't catch it
2. Living-off-the-land techniques: It uses legitimate Windows tools (PowerShell, Task Scheduler) to avoid detection
3. Credential focus: Its primary goal is stealing domain credentials, which gives attackers immediate access to your network

# This is the type of command SNOW might execute
# (DO NOT RUN THIS — for educational purposes only)

$TaskName = "Windows Update Service"
$TaskDescription = "Legitimate Windows maintenance task"
$Action = New-ScheduledTaskAction -Execute "C:\Windows\Temp\update.exe"
$Trigger = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger

This creates a scheduled task that runs malware at startup, making it nearly impossible to detect without proper endpoint monitoring.

How to Protect Your Business

As someone who's reviewed hundreds of Indian SMB security postures, I can tell you that most aren't prepared for this type of attack. Here's what you need to do:

Quick Wins You Can Implement Today

1. Restrict External Teams Invitations

In Microsoft Teams Admin Center, limit who can send chat invitations:

Teams Admin Center → Org-wide settings → Guest access
→ Disable "Allow guest access in Microsoft Teams"
→ Or restrict to verified domains only

2. Enable Conditional Access Policies

If you're using Azure AD (now Entra ID), create a policy that requires MFA for Teams logins:

Azure AD → Conditional Access → New Policy
→ Cloud apps: Microsoft Teams
→ Grant: Require multi-factor authentication

3. Create an IT Verification Procedure

Train your team to verify IT requests using this process:

1. If IT contacts you via Teams/email:
   "I'll verify this by calling our IT desk directly"

2. Hang up and call IT using the number from your company
   directory (NOT from the message)

3. Ask: "Did you just send me a Teams message about [topic]?"

4. If NO → Report it to security immediately

4. Check Your Teams Settings

Run this audit on your Teams instance:

# Using Microsoft Teams PowerShell module
Connect-MicrosoftTeams

# List all external access settings
Get-CsTeamsExternalAccessPolicy

# Check guest access status
Get-CsTeamsGuestMeetingConfiguration

# List all teams and their sensitivity labels
Get-Team | Select-Object DisplayName, Visibility, ResourceProvisioningOptions

The Credential Theft Connection

UNC6692's focus on credential harvesting tells us something important: they're after persistent access, not just a one-time data grab. Once they have valid domain credentials, they can:

1. Move laterally across your network
2. Access your cloud storage and email
3. Modify security settings to maintain backdoor access
4. Steal customer data over weeks or months

# On Windows systems, monitor these event IDs for failed logins:
# Event ID 4625 = Failed login attempt
# Event ID 4720 = New user account created
# Event ID 4722 = User account enabled
# Event ID 4756 = Member added to security group

# Use this PowerShell command to export failed logins:
Get-EventLog -LogName Security -InstanceId 4625 -After (Get-Date).AddDays(-1) | 
  Export-Csv -Path "C:\Logs\FailedLogins.csv" -NoTypeInformation

How Bachao.AI Detects This

This attack demonstrates exactly why we built Bachao.AI's Incident Response and Security Training products:

The reality is this: you can't prevent social engineering 100%, but you can detect it faster and respond better. That's what enterprise security teams do, and that's what we've made accessible for Indian SMBs.

Your 6-Hour DPDP Action Plan

If you suspect you've been compromised by UNC6692 or any threat group:

Hour 0-1: Isolate affected systems from the network Hour 1-3: Preserve evidence and contact your incident response team (or call us) Hour 3-5: Notify CERT-In at incident@cert-in.org.in with:

1. What happened
2. When you discovered it
3. What data may have been affected
4. What immediate actions you've taken

The Bottom Line

UNC6692's Teams impersonation attack is effective because it exploits something no firewall can protect against: human judgment. The best defense is a combination of:

1. User awareness — Train employees to verify requests
2. Technical controls — MFA, conditional access, Teams restrictions
3. Detection capability — Monitor for credential theft and unusual activity
4. Response readiness — Know your CERT-In notification process

If you want to test your organization's vulnerability to this attack, we can run a simulated Teams-based social engineering assessment and provide a detailed report on your security posture.

Book Your Free Security Assessment →

Written by Shouvik Mukherjee, Founder of Bachao.AI. I spent years architecting security for Fortune 500 companies before realizing that Indian SMBs needed the same level of protection — but at a price they could afford. Follow me on LinkedIn for daily insights on cybersecurity threats affecting Indian businesses.

Originally reported by The Hacker News

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.