UNC6692 Threat Group Exploits Microsoft Teams for Corporate Breaches
A threat group identified as UNC6692 has been compromising corporate networks since late December 2025 by impersonating IT helpdesk staff on Microsoft Teams to distribute a fake "Mailbox Repair Utility."
A newly identified threat group, tracked as UNC6692, has been actively breaching corporate networks since late December 2025 by impersonating IT helpdesk personnel on Microsoft Teams Help Net Security. The attackers utilize social engineering tactics to manipulate employees into downloading malicious software and surrendering sensitive credentials under the guise of a legitimate technical support request.
The primary mechanism of this attack involves the deployment of a fraudulent "Mailbox Repair Utility." By masquerading as internal IT staff, the threat actors gain the trust of their targets, convincing them to execute the malicious utility. Once installed, this tool facilitates unauthorized access to the victim's environment, allowing the attackers to compromise corporate systems and potentially exfiltrate data Help Net Security.
Google’s Threat Intelligence Group (GTIG) has been documenting the activities of UNC6692 throughout their ongoing campaign. The group’s methodology highlights a shift toward leveraging trusted communication channels like Microsoft Teams to bypass traditional security perimeters. By blending in with standard corporate workflows, the attackers effectively lower the guard of employees who are accustomed to receiving IT support via chat platforms Help Net Security.
The campaign, which began in late December 2025, underscores the persistent risk posed by sophisticated social engineering. Organizations are encouraged to remain vigilant against unexpected requests for software installation or credential verification, even when they appear to originate from internal departments. Security teams should emphasize that legitimate IT support processes rarely involve the unsolicited download of external utilities via chat applications Help Net Security.
This incident serves as a stark reminder of the evolving threat landscape, where attackers increasingly exploit the human element and trusted collaborative tools to gain initial access. As organizations continue to rely on platforms like Microsoft Teams for daily operations, threat actors will likely continue to refine these impersonation tactics. Security leaders should prioritize user awareness training specifically focused on identifying helpdesk impersonation and verifying the authenticity of software requests before execution Help Net Security.