Operation Turb00: Multi-Stage Vidar and SnappyClient Campaign

Operation Turb00 is a highly structured malware campaign identified in mid-2026, targeting German financial institutions and US organizations. The attack chain utilizes a modular HijackLoader (also known as IDAT Loader) to deploy two primary payloads: Vidar (v2.1), a 'smash-and-grab' infostealer, and SnappyClient, an advanced Remote Access Trojan (RAT). The campaign relies on social engineering, including fake software updates and spoofed websites (e.g., impersonating telecom brands), rather than exploit-based delivery.

Technically, the campaign is characterized by its heavy use of legitimate, signed binaries (such as Radmin VPN, Opera, and dBpoweramp) to host malicious code through DLL side-loading. HijackLoader stages its components within steganographic PNG-IDAT chunks to evade detection. Once active, the payloads utilize advanced evasion techniques like AMSI bypass, Heaven's Gate for cross-mode execution, and direct system calls to bypass security hooks. While Vidar focuses on rapid credential and cryptocurrency wallet theft, SnappyClient provides a persistent foothold for interactive C2 control, including remote desktop, file management, and reverse proxying.

This campaign highlights the evolution of the access economy, where stealers and RATs are deployed in parallel to maximize both immediate data theft and long-term network access. The reliance on trusted process identities and non-standard C2 protocols (e.g., custom TCP on ports 3333/3334 for SnappyClient) creates a significant blind spot for traditional signature-based security tools.