UNC6692 Combines Social Engineering, Malware, Cloud Abuse

This DarkReading digest highlights a wave of high-risk activity: a newly profiled UNC6692 campaign uses Microsoft Teams, abused AWS S3 buckets, and custom “Snow” malware in multi-stage cloud-centric social engineering attacks; an architectural, unpatched Windows RPC weakness dubbed “PhantomRPC” enables multiple privilege-escalation exploit paths; and active exploitation of a critical Bomgar RMM remote code execution flaw (CVE-2026-1731) demonstrates supply-chain risk. Other notable items include discovery of a 20-year-old fast16 malware framework predating Stuxnet, North Korean Lazarus ClickF­