Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

April 23, 2026 · Google Cloud Security · Severity: HIGH

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite. Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their vict. Security teams are urged to prioritize detection and response measures against this threat.