SnappyClientMalware
According to Zscaler, SnappyClient was first observed in December 2025. It is a C++-based C2 implant with the ability to steal data and provide remote access. SnappyClient employs multiple evasion techniques to hinder endpoint security detection, including an Antimalware Scan Interface (AMSI) bypass, as well as implementing Heaven’s Gate, direct system calls, and transacted hollowing.From MISP Galaxy
Last reported 4 months ago, by Group-IB2 reports
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 – Obfuscated Files or Information”
- T1041Exfiltration Over C2 Channel
“T1041 – Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“The second method utilizes Scheduled Tasks, allowing the malware to execute at predefined intervals or specific system events.”
- T1056Input Capture
“T1056 – Input Capture”
- T1056.001Keylogging
“These capabilities include keylogging functionality to capture user keystrokes and also clipboard monitoring, and clipping.”
- T1057Process Discovery
“T1057 – Process Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
SilabRAT, What’s Your Power?“SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums.”
-
Technical Analysis of SnappyClient“Technical Analysis of SnappyClient”
Indicators in its reports
named in the reports above- 61e103db36ebb577…e87e2fc5ee99in 1 report
- 23e2a0c25c95eebe…a89c3d49812ein 1 report
- 00019221fb0b61b7…6eaf92dbfe2fin 1 report
- 6e360fca0b1e3021…40557cd517d7in 1 report
- 64a2609d6707a2eb…bc8aa6bec2c8in 1 report
- 151.242.122[.]227in 1 report
- 179.43.167[.]210in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.