Operation Turb00 is a multi-stage initial-access and infostealer campaign documented in a two-part analysis by researcher Gianluca Tiepolo. The campaign began as a spear-phishing operation against a small number of German financial institutions between 14 and 17 June 2026, using lure emails presenting a malicious attachment as a mandatory VPN software update requiring immediate installation.

The initial payload is a 7-Zip self-extracting archive (`Setup.exe`, SHA-256 `1bb2771002bf8240e34e8284048bfc1db8dd7cdade7a7afb4a2cfbe02b1a9749`, 13.6 MB, 32-bit PE) that drops a genuine, validly signed copy of Radmin VPN (`WizardDa42.exe`) alongside a trojanized `Qt5Core.dll` bearing an invalid Authenticode signature. When Radmin VPN executes, Windows DLL search-order behavior causes it to load the malicious `Qt5Core.dll` from the same directory instead of the legitimate library (classic DLL side-loading / T1574.002), executing attacker code inside a trusted, signed process.

The trojaned DLL unpacks `shader128.map` (a 10 KB encrypted shellcode blob) into memory. The shellcode decrypts `scenesync45.xml`, an 8.4 MB file that is in reality a PNG-IDAT steganographic container: the file is a long run of PNG IDAT (image data) chunks terminated by an IEND marker, containing no real pixel data. The loader (identified as HijackLoader / IDAT Loader, aliases DOILoader, GHOSTPULSE, SHADOWLADDER) concatenates the IDAT chunks, applies a 4-byte XOR decryption (key `0x2746ea7e`, format marker `0xea79a5c6`), and decompresses the result with LZNT1, yielding a 12.4 MB bundle (compressed size `0x86a7e8`, decompressed size `0xbe760a`) containing 13 embedded PE files.

HijackLoader then deploys two parallel execution chains using signed host programs abused for process hollowing (T1055.012): the Vidar v2.1 payload (SHA-256 `debbb3b4fdd9107deec64c46b453b988c5b51a99e006f2c6d1c804b5e2a33991`, PE32+ x64, ~1.02 MB) is mapped into a suspended `NeuroManag.exe` (masquerading as dBpoweramp) via `NtMapViewOfSection` against a SEC_IMAGE section, with the process's PEB ImageBaseAddress redirected to Vidar's base before the process is resumed — the original host image remains mapped but PEB-unlinked. A second, parallel chain deploys the SnappyClient RAT into a suspended `VirtualAr.exe` using the same suspended-create/inject/resume pattern. SnappyClient establishes persistence via a Startup shortcut (`\Startup\prompt_analyzer_debug.lnk`) and a scheduled task (`C:\Windows\Tasks\socket_dispatcher_v2.job`), both of which relaunch `AlphVector.exe` to restart the full infection chain. The installation directory artifact is `C:\ProgramData\extadvanced_arm64\`.

Vidar v2.1 is a build-time-obfuscated evolution of Vidar v2.0 with identical capability parity: regenerated API hash seeds/multipliers, reassigned string decoder families, changed S-box permutations, shuffled VM opcode numbers, and enhanced anti-decompiler hardening (push/ret indirect jumps). It performs Chromium/Gecko browser database extraction (cookies, credentials, history), bypasses Chrome/Edge App-Bound Encryption by launching the real browser binary with `--no-first-run --disable-gpu about:blank`, targets cryptocurrency wallets (MetaMask IndexedDB, other wallet extensions), performs hardware/software reconnaissance, captures screenshots via GDI, terminates browser processes to release file locks, and exfiltrates data via multipart HTTPS form submission with base64-encoded fields. Its C2 configuration is delivered server-side over HTTPS, with Telegram and Steam community profiles used as fallback dead-drop channels for C2 updates. Vidar has no persistence mechanism — it operates as a run-once stealer.

SnappyClient (aka SilabRAT) is a C++-based Malware-as-a-Service RAT first observed in December 2025/documented by Zscaler ThreatLabz in March 2026, sold on darkweb forums. In this campaign it communicates with C2 infrastructure at 66.163.113[.]238 on ports 3333/3334. It provides browser data theft across ten browsers (Chrome, Firefox, Edge, Opera, Brave, etc.), harvesting saved passwords, session cookies, and full profiles; targets cryptocurrency wallets and extensions (MetaMask, Phantom, TronLink, Coinbase Wallet, TrustWallet) and standalone wallet applications (Exodus, Atomic, Electrum, Ledger Live); provides keylogging, screenshot capture, and remote shell/arbitrary command execution; and receives configuration updates from its C2. Evasion techniques include AMSI bypass, Heaven's Gate (32/64-bit transition), direct syscalls to bypass user-mode API hooks, and transacted hollowing. Network traffic is compressed with the Snappy algorithm and encrypted with ChaCha20-Poly1305, materially hindering network-based inspection. Prior Zscaler reporting places SnappyClient targeting across ten countries (US, China, Russia, South Korea, Japan, Germany, UK, Canada, Australia, Singapore) with a focus on cryptocurrency users/organizations.

The analysis emphasizes that behavioral detection is required over hash- or signature-based detection: 'If you build your detections around process names, file hashes, or even code-signing status, you will catch nothing here, because on every one of those axes this campaign looks completely clean.' Recommended detection anchors include unsigned/invalid-signature DLL loads alongside signed hosts, signed binaries executing from user-writable directories, process access with sensitive access masks originating from temporary locations, browsers launched with headless-style flags by non-browser parent processes, Sysmon Event ID 25 (process tampering / image-base mismatch), and .tmp image loads from user-writable paths. A YARA rule targeting the stable bytecode VM decoder, dispatch loop, and config XOR routine (rather than regenerated build-time constants) was published to enable cross-build detection despite Vidar's per-build obfuscation churn.