Wednesday 14 October 11:55 - 12:25, Green room
Muhammed Irfan V A, Avinash Kumar & Nirmal Singh (Zscaler)
SnappyClient is an emerging command-and-control (C2) framework implant that has been distributed exclusively through HijackLoader. SnappyClient stands out due to its capability of a full-featured remote access toolset that includes screen capture, keylogging, interactive terminal, and data theft while rapidly iterating through frequent version updates. In this talk, we introduce SnappyClient while explaining how its sophisticated, operator-customizable platform enables highly customized attacks driven by specific triggers. It can continuously monitor for defined conditions and automatically execute tailored actions when those conditions are met.
We will walk through SnappyClient's architecture, focusing on its embedded configurations and moving to the C2-delivered encrypted databases (EventsDB and SoftwareDB) that drive conditional workflows and targeted data theft. Attendees will learn how SnappyClient's operators remotely push event-driven behaviours (e.g. clipboard/window-title triggers) and dynamically specify what data gets collected without redeploying the implant. We will also unpack SnappyClient's layered crypto scheme used to protect its network configuration, along with its custom network communication protocol that compresses and encrypts JSON messages using Snappy and ChaCha20-Poly1305. Beyond internals, this research maps initial infection vectors used to deliver SnappyClient, focusing on the different lures and themes used, and the malware's C2 panel to highlight attacker-side UI features. This study will further cover key changes introduced after version 0.1.11, including updates to how the pairs configuration is parsed, and what those changes reveal about developers' intent.
Finally, we decrypt SnappyClient's post-compromise network activity to identify their motivations and objectives for the campaigns. We then look into SnappyClient's evasion techniques including AMSI bypass and process injection techniques that leverage Heaven's Gate, Direct Syscall and transacted hollowing to bypass protections such as Chromium App-Bound Encryption. This study also examines the operators behind the development of SnappyClient.
 |
Muhammed Irfan V A Muhammed Irfan V A works in Zscaler ThreatLabZ as a senior threat researcher. Irfan has worked in the malware research field for the past six years. He previously worked at LTIMindtree as a malware analyst. His work areas include tracking new campaigns and malware families and providing detection for them. Irfan holds a Bachelor's degree in cyber forensics from Mahathma Gandhi Uninverity.
|
 |
Avinash Kumar Avinash Kumar works at Zscaler ThreatLabZ as a senior manager – MalwareLabz – security researcher. He has worked in the threat research field for more than 15 years. He previously worked at Norman and Genpact as a senior malware analyst. His research areas include different malware categories with advance malware botnet and analysing the various campaigns on daily basis. Avinash holds a Master's degree in computer application from Punjab Technical University. Apart from malware research, he loves to play cricket and table tennis.
|
 |
Nirmal Singh Nirmal Singh is Senior Director for the security research team at Zscaler ThreatLabZ located at Chandigarh, India. Nirmal has a Ph.D. in computer science and has been working in the threat research and analysis field for the past 17 years. He oversees malware research, detection and innovation at Zscaler. Prior to Zscaler, he worked with Norman as a manager for the threat response team. |
Back to VB2026 conference page
Register your interest for VB2026