What's happening in email security: April 20 - April 26, 2026

UNC6692 floods inboxes, then shows up on Teams as the help desk

Google Threat Intelligence Group and Mandiant detailed UNC6692, a newly tracked group that starts its intrusions in the inbox, then moves to Microsoft Teams for the con. Step one is an email bomb. The target's mailbox fills with junk. Step two is a Teams message from an account outside the organization, posing as IT support and offering to fix the spam problem the attacker just created.

The "fix" is a link to a page titled "Mailbox Repair and Sync Utility v2.1.5." The page only loads from a link carrying the target's email address, and it pushes anyone not on Microsoft Edge into Edge. From there it pulls an AutoHotkey script from an attacker-controlled AWS S3 bucket. The script runs reconnaissance and installs SNOWBELT, a malicious browser extension that runs in a hidden, headless Edge window and serves as the first backdoor. Through it, the operators pull down SNOWGLAZE, a Python tunneler that opens a WebSocket tunnel to their server, and SNOWBASIN, a persistent backdoor that runs commands, takes screenshots and moves files. The same page shows a "Health Check" button that asks for mailbox credentials and sends them to a second S3 bucket.

The intrusion Mandiant walked through ended with the keys to the domain. The group scanned the network, opened a PsExec session on the victim's machine, used RDP to reach a backup server, dumped LSASS memory there, used Pass-the-Hash to get to the domain controllers, and copied the Active Directory database with FTK Imager. Data left through the LimeWire file upload tool. Pairing an inbox flood with a fake help desk chat is a playbook long tied to former Black Basta affiliates, and it has outlived the group's ransomware operation.

The lesson for email teams is that an inbox flood isn't just spam. It's the setup. If your filtering treats a sudden burst of bulk mail to one person as noise, you miss the moment right before the social engineering starts. Tie that alert to any external Teams contact with the same user, and limit who outside your organization can start a Teams chat with your staff in the first place.

Harvester's Linux backdoor takes its orders from an Outlook folder

Symantec and Carbon Black's Threat Hunter Team found a Linux version of GoGra, a backdoor used by the Harvester espionage group, and its command channel is an Outlook mailbox. The malware uses the Microsoft Graph API to check a mail folder named "Zomato Pizza" every two seconds. Emails with subjects starting with "Input" carry AES-encrypted, Base64-wrapped commands, which the backdoor decrypts and runs with /bin/bash. Results go back to the operator in an email with the subject "Output," and the original tasking message gets deleted.

Targets are sent ELF binaries dressed up as PDF documents, and a decoy document opens while the backdoor runs in the background. Artifacts uploaded to VirusTotal from India and Afghanistan suggest the campaign is aimed at those two countries. Harvester has used Graph API for command and control since Symantec first documented it in late 2021, and the researchers found matching hard-coded spelling errors in the Windows and Linux versions, which points to the same developer.

Because the implant signs in to the attacker's own Microsoft tenant with hard-coded credentials, none of the polling or deleted messages ever shows up in your Microsoft 365 logs. The place to catch it is the endpoint. Look for a Linux process calling the Graph API every two seconds when it has no business talking to Microsoft at all, and for an autostart entry posing as the Conky system monitor.

NASA's watchdog details five years of phishing for U.S. defense software

NASA's Office of Inspector General published the backstory on Song Wu, a Chinese national charged with spending January 2017 to December 2021 posing as U.S. researchers and engineers to get export-controlled software. The case started with a report about a Gmail account impersonating an established aerospace professor who often worked with NASA. The impersonator was messaging the professor's colleagues asking for export-controlled software and source code, including aerospace engineering software NASA develops and maintains.

He targeted dozens of professors, researchers and engineers at NASA, the Air Force, the Navy, the Army, the Federal Aviation Administration, universities and private companies, looking for modeling software used in aerospace design and weapons development. Song and his co-conspirators researched targets heavily and posed as their friends and colleagues. The OIG says that in some instances it worked, and victims shared the software without realizing they were breaking export control laws. Song, an engineer at a Chinese state-owned aerospace and defense conglomerate, was indicted in September 2024 on 14 counts of wire fraud and 14 counts of aggravated identity theft. He remains at large, and the FBI has added him to its Most Wanted list.

The whole scheme ran on a free webmail account, a borrowed name and requests that sounded routine. The red flags the OIG lists are all behavioral: repeated requests for the same software with no explanation, unusual payment methods, abrupt changes to payment terms, and unconventional transfer methods. None of that trips a content filter, and DMARC can't help when the sender never claimed your domain in the first place. What does help is flagging mail where a known contact's name arrives from a consumer address they've never used before.