Malware

SNAPPYBEE

Also known as: Deed RAT · POISONPLUG.DEED

Indicators of Compromise 18

Domain aar[.]gandhibludtric[.]com Filename 1.txt Filename 123.tar Filename 123.txt Filename DgApi.dll Filename Dialog.dat Filename DisplayDialog.exe Filename NortonLog.txt Filename WINMM.dll Filename dbindex.dat Filename fltLib.dll Filename imfsbDll.dll Filename imfsbSvc.exe Filename pdc.exe SHA-1 b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 IP 156[.]244[.]28[.]153 IP 38[.]54[.]63[.]75 IP 89[.]31[.]121[.]101

MITRE ATT&CK TTPs 7

T1071.001
Web Protocols
Command And Control
 T1095
Non-Application Layer Protocol
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1190
Exploit Public-Facing Application
Initial Access
 T1571
Non-Standard Port
Command And Control
 T1574.001
DLL Search Order Hijacking
Persistence
 T1665
Hide Infrastructure
Command And Control

Source Articles

Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion
Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.
dark-trace