Vidar CadenceOptimizer Service Persistence via CorsairUtil agt.dll (Operation Turb00)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•6

Detects persistence mechanisms used by Vidar/SnappyClient (Operation Turb00), specifically the creation of a malicious Windows service named CadenceOptimizer and the hijacking of a Svchost service-group (Brn_Agent) to load a malicious DLL (agt.dll) from the ProgramData directory with SYSTEM privileges.