# SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3)

> SnappyClient is a C++-based command-and-control implant first identified by Zscaler ThreatLabz in December 2025 and further unmasked in Gianluca Tiepolo's 'Operation Turb00 — Part 3'. Delivered via a parallel HijackLoader chain that hides the RAT inside a fake Microsoft DLL and process-hollows it into a signed Qihoo 360 binary, it combines AMSI bypass, Heaven's Gate, direct syscalls, and transacted hollowing for evasion with browser data theft, keylogging, screenshots, remote shell/VNC access, and an aggressive cryptocurrency-wallet theft focus.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1589
- **ID:** TL-2026-1589
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SnappyClient is a full-featured, C++-written remote access trojan and command-and-control (C2) framework that Zscaler ThreatLabz first documented in December 2025, with independent corroboration from GBHackers and a deep three-part investigation ('Operation Turb00') published by CTI researcher Gianluca Tiepolo, culminating in Part 3 (2026-07-02) which reverse-engineers the implant end-to-end.

Delivery occurs via a dedicated, parallel HijackLoader (aka IDAT Loader / GHOSTPULSE / SHADOWLADDER) infection chain distinct from the chain used to deliver Vidar v2.1 in the earlier parts of the same campaign. The loader hides SnappyClient inside a fake Microsoft-branded DLL and process-hollows the payload into a legitimately signed Qihoo 360 binary to inherit trust and evade signature-based defenses. SnappyClient's own C2 configuration is buried behind six stacked layers of compression and encryption, requiring the researcher to peel back each layer to recover the C2 infrastructure. Initial infection vectors observed in the broader campaign include phishing pages impersonating a German telecommunications brand (Telefónica O2) and ClickFix-style fake-CAPTCHA/fake-fix social engineering that chains into GhostPulse/HijackLoader before SnappyClient injection.

Once running, SnappyClient installs a trampoline hook on LoadLibraryExW to detect when amsi.dll is loaded, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN, neutralizing AMSI-based detection. It uses the Heaven's Gate technique together with direct x64 system calls (issued from a freshly mapped copy of ntdll) to bypass user-mode API hooking employed by EDR/AV products — a methodology that closely mirrors HijackLoader's own implementation, down to an almost one-to-one API structure layout, suggesting shared developers between the two tool families. Process injection is performed via transacted hollowing, the same technique borrowed from HijackLoader, which SnappyClient additionally weaponizes to defeat Chromium's App-Bound Encryption: by injecting into a trusted process and abusing the browser's IElevator COM interface, it recovers the AES-256 master key used to protect saved passwords and cookies.

Operationally, SnappyClient supports screenshot capture (monitor-specific, JPEG), keystroke logging with file-based exfiltration, clipboard monitoring, full remote shell access, process enumeration/suspend/resume/termination, recursive file browsing/archiving/copy/delete, and reverse-proxy tunneling for VNC, FTP, RLOGIN, and SOCKS5. Persistence is optional and implemented via scheduled tasks or HKCU/HKLM Run-key registry entries, and the implant enforces single-instance execution through named shared-memory objects with a 'banned device' hash-marker mechanism, alongside UAC bypass via the CMSTPLUA COM interface.

The implant's cryptocurrency focus is extensive and config-driven. Its embedded EventsDB (JSON, regex/wildcard-based) fires screenshot and clipboard-exfiltration actions when clipboard content matches an Ethereum address pattern (^0x[a-fA-F0-9]{40}$) or when a foreground window title references Binance, Coinbase, Exodus, or Atomic Wallet. Its SoftwareDB targets browser extensions for Coinbase Wallet, MetaMask, Phantom, TronLink, and TrustWallet, and standalone desktop wallet applications including Atomic, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, and Wasabi Wallet, alongside generic Chromium/Firefox browser-profile cloning (History, Preferences, Bookmarks, Local/Session Storage, Extensions).

Network communications use a custom TCP protocol authenticated and encrypted end-to-end with ChaCha20-Poly1305. The initial handshake exchanges a 32-byte ChaCha20 key and 12-byte nonce; subsequent messages are Snappy-compressed before encryption and framed with a header containing a command_ID (WORD), message_id (DWORD), and message_length (DWORD). The implant maintains a single control session (command dispatch) plus multiple parallel data sessions used for file transfer. Confirmed C2 endpoints from the Zscaler analysis are 151.242.122.227 (ports 3333/control, 3334/data) and 179.43.167.210 (ports 3333/control, 3334/data). Rich host reconnaissance (hostname, username, OS/CPU/RAM, installed AV, monitor layout, EventsDB/SoftwareDB config hashes) is transmitted to the C2 on check-in.

No CVE applies — SnappyClient is a malware family, not a vulnerability, and no formal threat-actor name has been publicly attributed; researchers link it to the HijackLoader developer ecosystem via code-level and structural overlap, with a financially-motivated, cryptocurrency-theft-centric operational profile.

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1106 Native API
- T1218 System Binary Proxy Execution
- T1036 Masquerading
- T1553.002 Code Signing
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1010 Application Window Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518.001 Security Software Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1573.001 Symmetric Cryptography
- T1571 Non-Standard Port
- T1090.002 External Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Operation Turb00 — Part 3: Unmasking the SnappyClient RAT](https://malpedia.caad.fkie.fraunhofer.de/library/bf195447-cc17-4d5d-b676-d30e7844b8fe/)
- [SnappyClient Implant Blends Remote Access, Data Theft, and Stealth Evasion](https://gbhackers.com/snappyclient-implant/)
- [Technical Analysis of SnappyClient](https://www.zscaler.com/blogs/security-research/technical-analysis-snappyclient)
- [New C2 Implant 'SnappyClient' Targets Crypto Wallets](https://www.darkreading.com/cyberattacks-data-breaches/new-c2-implant-snappyclient-targets-crypto-wallets)
- [Operation Turb00 — Part 2: A Multi-Stage HijackLoader Campaign Delivers Vidar v2.1](https://mrtiepolo.medium.com/operation-turb00-part-2-a-multi-stage-hijackloader-campaign-delivers-vidar-v2-1-60d4bea17255)
- [HijackLoader (Malware Family) — Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.hijackloader)
- [HijackLoader Expands Techniques to Improve Defense Evasion](https://www.crowdstrike.com/en-us/blog/hijackloader-expands-techniques/)
- [New HijackLoader Evasion Tactics](https://www.zscaler.com/blogs/security-research/analyzing-new-hijackloader-evasion-tactics)
- [HijackLoader | Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/hijackloader/)
- [Triage Security: Technical Analysis of the SnappyClient C2 Implant and Delivery Mechanisms](https://triagesecurity.ai/blog/5fe5eb73-25f2-46af-a581-02edefcfedf1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1589