GitHub Copilot Security: How UNC6692 Weaponizes Legitimate Tools as APT Infrastructure

UNC6692 APT uses Microsoft Teams, AWS S3, Snow malware for command and control. How to detect advanced threats hiding in legitimate infrastructure.

GitHub Copilot Security: How UNC6692 Weaponizes Legitimate Tools as APT Infrastructure

We've optimized our security infrastructure around the assumption that "trusted" tools are safe. Your development team uses GitHub. Your communications run through Microsoft Teams. Your infrastructure lives in AWS. These tools have security controls, logging, API authentication.

UNC6692 is operating from a different assumption: trusted tools are the perfect command and control infrastructure because defenders don't look there.

A newly discovered threat actor—tracked by Dark Reading and first documented in April 2026—is combining three attack vectors: social engineering via Microsoft Teams, malware droppers in AWS S3 buckets, and custom "Snow" malware that communicates through legitimate channels. The pattern reveals why defending against modern APTs requires treating infrastructure tools as potential attack surfaces.

The UNC6692 Attack Chain: Layers of Legitimate Infrastructure

Here's what a typical UNC6692 campaign looks like:

Phase 1: Social Engineering on Teams — Threat actor gains initial access by impersonating IT support on Microsoft Teams (often through compromised credentials or social engineering). They message a target: "Update your authentication requirements—click here." The link leads to a phishing page or a malware dropper.

Phase 2: Malware Deployment via S3 — Instead of hosting malware on attacker-controlled infrastructure (which security teams scan for), the malware binary is uploaded to a victim organization's AWS S3 bucket—often an existing, legitimate bucket used for backups or shared files. The S3 bucket URL is whitelisted by corporate firewalls. Detection tools don't flag it because it comes from the organization's own infrastructure.

Phase 3: Snow Malware Activation — Once deployed, the Snow malware establishes persistence. Unlike traditional RATs (remote access trojans) that connect to attacker-controlled servers, Snow communicates through legitimate APIs. It exfiltrates data via:

Azure Blob Storage (using compromised credentials)
OneDrive API calls (blending into normal sync traffic)
AWS CloudWatch API (logging exfiltration as if it were application telemetry)

The command and control channel? Slack webhooks or email (the attacker sends commands via email to an account the malware monitors). The attacker never needs to register a domain or host a server.

Why Traditional Threat Intelligence Fails Here

Your security team has a list of blocked domains. You have EDR (Endpoint Detection and Response) tools monitoring for suspicious network connections. You have URL filtering that blocks phishing sites.

None of this stops UNC6692 because they're not using attacker infrastructure. They're using your infrastructure. Your trusted tools. Your whitelisted services.

In one documented case, UNC6692 gained access to an organization's AWS account, then exfiltrated 2TB of sensitive data over 6 weeks by uploading it to the organization's own S3 bucket—then accessing it remotely. The data transfer appeared in CloudTrail logs as normal account activity. It appeared in network egress logs as traffic to an internal AWS endpoint.

Microsoft Teams as an attack surface deserves specific attention. Teams webhooks allow external services to post messages. UNC6692 creates a webhook in a legitimate Teams workspace (or a workspace they control after compromising accounts), then uses it as a notification system: malware beacons back to the webhook when it reaches a target. The command and control conversation happens in a Teams channel that looks like normal business chat.

Detection Strategy: Behavioral Anomalies Over Infrastructure Analysis

You can't block Teams, AWS, or S3—they're essential business tools. So detection has to shift from "is this infrastructure suspicious?" to "is this usage pattern suspicious?"

1. S3 Bucket Access Patterns — Set baseline: where is your S3 data normally accessed from? If a malware-infected endpoint is accessing your backup S3 bucket at 3 AM from an IP in a different geographic region than your normal access patterns, that's anomalous. Alert.

2. Teams Webhook Activity — Monitor who creates webhooks and what's posted through them. A webhook created by an IT admin is expected. A webhook created by an intern, then used to send binary data encoded as base64 strings? That's suspicious.

3. Azure/AWS API Anomalies — Defenders should monitor:

Unusual volume of UploadBlob calls (data exfiltration signature)
API calls from endpoints that don't normally make API calls
Credentials being used from geographic regions they've never appeared from before
Service principals or apps making API calls at unusual hours

4. Email Forwarding Rules — Once UNC6692 gains mailbox access, they often create forwarding rules (attacker@external receives copies of all incoming email). Monitor for new forwarding rules, especially those created by non-admin accounts.

Defense Layers Your Organization Should Implement

Immediate:

Enable conditional access policies on Teams, Azure, and AWS. Require MFA for all external access. Alert on impossible travel (same user in San Francisco at 2 PM, Tokyo at 2:30 PM).
Audit all webhooks in Teams. Do they belong there? Who created them? What are they posting?
Enable S3 bucket logging and analyze it. You should know which IPs and principals are accessing your data.

Short-term:

Implement data exfiltration detection in your cloud environment. Flag any data movement that's unusual for your organization (large uploads to cloud storage, unusual API call patterns).
Restrict who can create Teams webhooks, Azure registered apps, and AWS IAM roles. These are powerful tools; they shouldn't be created without approval.
Use your EDR tool to monitor for Snow malware signatures and behavioral patterns (malware attempting to read from specific registry keys, attempting to access Azure/AWS credential stores).

Long-term:

Adopt zero-trust principles for your infrastructure tools. Don't assume that because traffic is going to AWS or Teams, it's legitimate. Verify the intent of every API call.
Implement cloud access security brokers (CASBs) that monitor and control access to SaaS applications and cloud storage. They can detect unusual data movement that traditional firewalls miss.

Why This Matters for Development Teams

Developers use GitHub, Teams, and cloud infrastructure as part of their daily workflow. Securing these environments while maintaining usability is the challenge UNC6692 is exploiting. But it's solvable with the right monitoring:

GitHub: Monitor for unusual repository access patterns, new SSH keys added to service accounts, unusual push activity from unexpected IPs.
Teams: Monitor for unusual message patterns, file sharing patterns, webhook creation.
Cloud infrastructure: Monitor for unusual API call patterns, credential usage from unexpected locations, data movement outside normal patterns.

The next generation of APT attacks won't use attacker-controlled infrastructure. They'll hide in the tools you've already whitelisted. Defending against that requires treating your trusted tools as potential attack surfaces and monitoring for behavioral anomalies instead of relying on infrastructure reputation.