A newly identified threat group, UNC6692, is conducting targeted social engineering attacks against enterprise employees by impersonating IT helpdesk staff through Microsoft Teams. Attackers use email bombing to overwhelm targets, then call via Teams posing as support, gaining remote access through Microsoft Quick Assist before deploying a custom three-component malware suite. The campaign is assessed as a direct precursor to ransomware deployment and Active Directory compromise, with 77% of observed incidents targeting senior-level employees between March and April 2026.