# Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography

> A targeted spear-phishing campaign against German financial institutions (14-17 June 2026) used a trojanized Radmin VPN installer to DLL-sideload HijackLoader (IDAT Loader), which unpacks a PNG-IDAT steganographic container via 4-byte XOR and LZNT1 decompression to deploy Vidar v2.1 infostealer via process hollowing and the SnappyClient RAT via a parallel persistence chain.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1213
- **ID:** TL-2026-1213
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation Turb00 is a multi-stage initial-access and infostealer campaign documented in a two-part analysis by researcher Gianluca Tiepolo. The campaign began as a spear-phishing operation against a small number of German financial institutions between 14 and 17 June 2026, using lure emails presenting a malicious attachment as a mandatory VPN software update requiring immediate installation.

The initial payload is a 7-Zip self-extracting archive (`Setup.exe`, SHA-256 `1bb2771002bf8240e34e8284048bfc1db8dd7cdade7a7afb4a2cfbe02b1a9749`, 13.6 MB, 32-bit PE) that drops a genuine, validly signed copy of Radmin VPN (`WizardDa42.exe`) alongside a trojanized `Qt5Core.dll` bearing an invalid Authenticode signature. When Radmin VPN executes, Windows DLL search-order behavior causes it to load the malicious `Qt5Core.dll` from the same directory instead of the legitimate library (classic DLL side-loading / T1574.002), executing attacker code inside a trusted, signed process.

The trojaned DLL unpacks `shader128.map` (a 10 KB encrypted shellcode blob) into memory. The shellcode decrypts `scenesync45.xml`, an 8.4 MB file that is in reality a PNG-IDAT steganographic container: the file is a long run of PNG IDAT (image data) chunks terminated by an IEND marker, containing no real pixel data. The loader (identified as HijackLoader / IDAT Loader, aliases DOILoader, GHOSTPULSE, SHADOWLADDER) concatenates the IDAT chunks, applies a 4-byte XOR decryption (key `0x2746ea7e`, format marker `0xea79a5c6`), and decompresses the result with LZNT1, yielding a 12.4 MB bundle (compressed size `0x86a7e8`, decompressed size `0xbe760a`) containing 13 embedded PE files.

HijackLoader then deploys two parallel execution chains using signed host programs abused for process hollowing (T1055.012): the Vidar v2.1 payload (SHA-256 `debbb3b4fdd9107deec64c46b453b988c5b51a99e006f2c6d1c804b5e2a33991`, PE32+ x64, ~1.02 MB) is mapped into a suspended `NeuroManag.exe` (masquerading as dBpoweramp) via `NtMapViewOfSection` against a SEC_IMAGE section, with the process's PEB ImageBaseAddress redirected to Vidar's base before the process is resumed — the original host image remains mapped but PEB-unlinked. A second, parallel chain deploys the SnappyClient RAT into a suspended `VirtualAr.exe` using the same suspended-create/inject/resume pattern. SnappyClient establishes persistence via a Startup shortcut (`\Startup\prompt_analyzer_debug.lnk`) and a scheduled task (`C:\Windows\Tasks\socket_dispatcher_v2.job`), both of which relaunch `AlphVector.exe` to restart the full infection chain. The installation directory artifact is `C:\ProgramData\extadvanced_arm64\`.

Vidar v2.1 is a build-time-obfuscated evolution of Vidar v2.0 with identical capability parity: regenerated API hash seeds/multipliers, reassigned string decoder families, changed S-box permutations, shuffled VM opcode numbers, and enhanced anti-decompiler hardening (push/ret indirect jumps). It performs Chromium/Gecko browser database extraction (cookies, credentials, history), bypasses Chrome/Edge App-Bound Encryption by launching the real browser binary with `--no-first-run --disable-gpu about:blank`, targets cryptocurrency wallets (MetaMask IndexedDB, other wallet extensions), performs hardware/software reconnaissance, captures screenshots via GDI, terminates browser processes to release file locks, and exfiltrates data via multipart HTTPS form submission with base64-encoded fields. Its C2 configuration is delivered server-side over HTTPS, with Telegram and Steam community profiles used as fallback dead-drop channels for C2 updates. Vidar has no persistence mechanism — it operates as a run-once stealer.

SnappyClient (aka SilabRAT) is a C++-based Malware-as-a-Service RAT first observed in December 2025/documented by Zscaler ThreatLabz in March 2026, sold on darkweb forums. In this campaign it communicates with C2 infrastructure at 66.163.113[.]238 on ports 3333/3334. It provides browser data theft across ten browsers (Chrome, Firefox, Edge, Opera, Brave, etc.), harvesting saved passwords, session cookies, and full profiles; targets cryptocurrency wallets and extensions (MetaMask, Phantom, TronLink, Coinbase Wallet, TrustWallet) and standalone wallet applications (Exodus, Atomic, Electrum, Ledger Live); provides keylogging, screenshot capture, and remote shell/arbitrary command execution; and receives configuration updates from its C2. Evasion techniques include AMSI bypass, Heaven's Gate (32/64-bit transition), direct syscalls to bypass user-mode API hooks, and transacted hollowing. Network traffic is compressed with the Snappy algorithm and encrypted with ChaCha20-Poly1305, materially hindering network-based inspection. Prior Zscaler reporting places SnappyClient targeting across ten countries (US, China, Russia, South Korea, Japan, Germany, UK, Canada, Australia, Singapore) with a focus on cryptocurrency users/organizations.

The analysis emphasizes that behavioral detection is required over hash- or signature-based detection: 'If you build your detections around process names, file hashes, or even code-signing status, you will catch nothing here, because on every one of those axes this campaign looks completely clean.' Recommended detection anchors include unsigned/invalid-signature DLL loads alongside signed hosts, signed binaries executing from user-writable directories, process access with sensitive access masks originating from temporary locations, browsers launched with headless-style flags by non-browser parent processes, Sysmon Event ID 25 (process tampering / image-base mismatch), and .tmp image loads from user-writable paths. A YARA rule targeting the stable bytecode VM decoder, dispatch loop, and config XOR routine (rather than regenerated build-time constants) was published to enable cross-build detection despite Vidar's per-build obfuscation churn.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1036.005 Match Legitimate Resource Name or Location
- T1574.001 DLL
- T1027.003 Steganography
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1218 System Binary Proxy Execution
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1102.001 Dead Drop Resolver
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction

## Sources

- [Operation Turb00 — Part 2: A Multi-Stage HijackLoader Campaign Delivers Vidar v2.1](https://mrtiepolo.medium.com/operation-turb00-part-2-a-multi-stage-hijackloader-campaign-delivers-vidar-v2-1-60d4bea17255)
- [Operation Turb00 — Part 1: Analyzing and Hunting a Vidar Campaign](https://malpedia.caad.fkie.fraunhofer.de/library/3c8ef644-3926-4c2c-8a3f-7795730298f1/)
- [Technical Analysis of SnappyClient](https://radar.offseq.com/threat/technical-analysis-of-snappyclient-9437d7d7)
- [HijackLoader (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.hijackloader)
- [Technical Analysis of SnappyClient | ThreatLabz](https://www.zscaler.com/blogs/security-research/technical-analysis-snappyclient)
- [New IDAT loader version uses steganography to push Remcos RAT](https://www.bleepingcomputer.com/news/security/new-idat-loader-version-uses-steganography-to-push-remcos-rat/)
- [New SnappyClient Implant Combines Remote Access, Data Theft and Advanced Evasion](https://cybersecuritynews.com/new-snappyclient-implant-combines/)
- [C2 Implant 'SnappyClient' Targets Crypto Wallets](https://www.darkreading.com/cyberattacks-data-breaches/new-c2-implant-snappyclient-targets-crypto-wallets)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1213