SnappyClient
- First seen
- 2025-12-01 00:00:00
- Malware type
- rat, backdoor
- Family
- Malware family
- Last IoC activity
- 2026-07-22 02:06:29
- Profile updated
- 2026-07-07 15:05:26
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
According to Zscaler, SnappyClient was first observed in December 2025. It is a C++-based C2 implant with the ability to steal data and provide remote access. SnappyClient employs multiple evasion techniques to hinder endpoint security detection, including an Antimalware Scan Interface (AMSI) bypass, as well as implementing Heaven’s Gate, direct system calls, and transacted hollowing. SnappyClient receives two configuration files from the C2 server, which contain a list of actions to perform when a specified condition is met, along with another that specifies applications to target for data theft. SnappyClient uses a custom network communication protocol that encrypts all network communication using ChaCha20-Poly1305.
Reports & references
- zscaler.com — Technical Analysis Snappyclient (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Snappy Client (report)
- blog.netomize.ca — Detect Snappyclient C C Traffic Using Packetsmith Yara X Detection Module (report)