SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3) — Threadlinqs Intelligence
As of 2026-07-21, SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1589 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
SnappyClient is a C++-based command-and-control implant first identified by Zscaler ThreatLabz in December 2025 and further unmasked in Gianluca Tiepolo's 'Operation Turb00 — Part 3'. Delivered via a
SnappyClient is a full-featured, C++-written remote access trojan and command-and-control (C2) framework that Zscaler ThreatLabz first documented in December 2025, with independent corroboration from GBHackers and a deep three-part investigation ('Operation Turb00') published by CTI researcher Gianluca Tiepolo, culminating in Part 3 (2026-07-02) which reverse-engineers the implant end-to-end.
Delivery occurs via a dedicated, parallel HijackLoader (aka IDAT Loader / GHOSTPULSE / SHADOWLADDER) infection chain distinct from the chain used to deliver Vidar v2.1 in the earlier parts of the same campaign. The loader hides SnappyClient inside a fake Microsoft-branded DLL and process-hollows the payload into a legitimately signed Qihoo 360 binary to inherit trust and evade signature-based defenses. SnappyClient's own C2 configuration is buried behind six stacked layers of compression and encryption, requiring the researcher to peel back each layer to recover the C2 infrastructure. Initial infection vectors observed in the broader campaign include phishing pages impersonating a German telecommunications brand (Telefónica O2) and ClickFix-style fake-CAPTCHA/fake-fix social engineering that chains into GhostPulse/HijackLoader before SnappyClient injection.
Once running, SnappyClient installs a trampoline hook on LoadLibraryExW to detect when amsi.dll is loaded, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN, neutralizing AMSI-based detection. It uses the Heaven's Gate technique together with direct x64 system calls (issued from a freshly mapped copy of ntdll) to bypass user-mode API hooking employed by EDR/AV products — a methodology that closely mirrors HijackLoader's own implementation, down to an almost one-to-one API structure layout, suggesting shared developers between the two tool families. Process injection is performed via transacted hollowing, the same technique borrowed from HijackLoader, which SnappyClient additionally weaponizes to defeat Chromium's App-Bound Encryption: by injecting into a trusted process and abusing the browser's IElevator COM interface, it recovers the AES-256 master key used to protect saved passwords and cookies.
Operationally, SnappyClient supports screenshot capture (monitor-specific, JPEG), keystroke logging with file-based exfiltration, clipboard monitoring, full remote shell access, process enumeration/suspend/resume/termination, recursive file browsing/archiving/copy/delete, and reverse-proxy tunneling for VNC, FTP, RLOGIN, and SOCKS5. Persistence is optional and implemented via scheduled tasks or HKCU/HKLM Run-key registry entries, and the implant enforces single-instance execution through named shared-memory objects with a 'banned device' hash-marker mechanism, alongside UAC bypass via the CMSTPLUA COM interface.
The implant's cryptocurrency focus is extensive and config-driven. Its embedded EventsDB (JSON, regex/wildcard-based) fires screenshot and clipboard-exfiltration actions when clipboard content matches an Ethereum address pattern (^0x[a-fA-F0-9]{40}$) or when a foreground window title references Binance, Coinbase, Exodus, or Atomic Wallet. Its SoftwareDB targets browser extensions for Coinbase Wallet, MetaMask, Phantom, TronLink, and TrustWallet, and standalone desktop wallet applications including Atomic, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, and Wasabi Wallet, alongside generic Chromium/Firefox browser-profile cloning (History, Preferences, Bookmarks, Local/Session Storage, Extensions).
Network communications use a custom TCP protocol authenticated and encrypted end-to-end with ChaCha20-Poly1305. The initial handshake exchanges a 32-byte ChaCha20 key and 12-byte nonce; subsequent messages are Snappy-compressed before encryption and framed with a header containing a command_ID (WORD), message_id (DWORD), and message_length (DWORD). The implant maintains a single control session (command dispatch) plus multiple paralle
Target sectors: finance, cryptocurrency, telecoms, individual consumer
Target regions: Europe, germany, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204.002, T1053.005, T1547.001, T1548.002, T1055, T1562.001, T1055.012, T1140, T1027