SnappyClient

SnappyClient, also tracked as SilabRAT, is a C++ Windows remote-access trojan and command-and-control implant first observed in December 2025. It is designed for persistent post-compromise access, surveillance, data theft, and financially motivated cryptocurrency theft. It can capture screenshots, log keystrokes, provide remote shell and remote file-browsing functions, manage processes and files, execute files, steal browser passwords, cookies, profiles, extensions, and application data, and exfiltrate collected information. It also supports reverse-proxy services including VNC, SOCKS5, FTP, and RLOGIN.

SnappyClient targets browser and cryptocurrency activity, including wallet extensions and cryptocurrency applications, and can monitor clipboard content and cryptocurrency-related window titles. It can obtain Chromium encryption material through process-hollowing techniques to bypass Chromium App-Bound Encryption protections. The implant communicates through a custom TCP protocol using Snappy compression and ChaCha20-Poly1305 encryption, and can receive updated configuration and target definitions from its command-and-control infrastructure.

The malware employs AMSI bypassing, direct system calls via Heaven’s Gate, clean system-library mapping, process injection or transacted hollowing, and other anti-analysis measures. Persistence is established using scheduled tasks or Windows autorun mechanisms. Observed intrusion chains have used HijackLoader to deploy SnappyClient, including fake telecommunications-themed download sites, ClickFix social engineering, and spear-phishing campaigns using trojanized installers and DLL side-loading. Code and tradecraft overlaps with HijackLoader have been observed, although a common developer relationship has not been conclusively established.