UNC6692 Phishing Campaign Deploying Custom Edgecution Malware Suite

In late 2025 and mid-2026, threat actor UNC6692, an initial access broker for the Payouts King ransomware group, launched a series of sophisticated phishing campaigns. The attacks begin with 'email bombing' to overwhelm targets, followed by social engineering via Microsoft Teams where actors impersonate internal IT support. Victims are coerced into using Quick Assist or installing a 'patch' from malicious Amazon S3 buckets, which leads to the deployment of the Edgecution malware suite (also known as the SNOW malware ecosystem).

Technically, the campaign leverages a malicious Microsoft Edge browser extension that bypasses traditional sandboxing using the Chrome native messaging protocol. This extension communicates with a Python-based native host, enabling the attackers to execute arbitrary shell commands, capture screens, and perform lateral movement. The modular suite includes components like SNOWBELT (extension), SNOWGLAZE (tunneler), and SNOWBASIN (bindshell), which collectively provide persistent authenticated access to the victim's internal network.

This campaign is highly significant due to its effective blending of high-pressure social engineering with technical evasion. By 'living off the cloud' via AWS S3 and Heroku, UNC6692 successfully bypasses many reputation-based filters. The threat is urgent for organizations in the software and commercial sectors, as the actor's primary goal is facilitating high-impact ransomware deployments.