SnappyClient Delivery via AlphVector.exe DLL Sideload and Job/LNK Persistence (Operation Turb00)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•1

Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.