Loading malware…
SnappyBee, also known as Deed RAT or DeedRAT, is a modular Windows backdoor and remote access trojan associated with multiple China-nexus espionage operations. It is widely assessed as a successor or evolutionary branch of ShadowPad, sharing loader design, configuration structure, custom payload formatting, plugin architecture, and persistence tradecraft. The malware has been linked to activity attributed to groups including Space Pirates and Earth Estries, and has also been observed in operations associated with Salt Typhoon and UAT-8302. Victim sectors and environments tied to its use include government, telecommunications, aerospace, energy, and oil and gas organizations across multiple regions.
SnappyBee is commonly deployed after initial compromise rather than as a mass-distributed payload. Observed intrusion chains include exploitation of internet-facing Microsoft Exchange servers, deployment of web shells, and DLL sideloading through legitimate software to launch a malicious loader and encrypted payload. Multiple campaigns used carefully staged sideloading chains in which a benign executable loads a malicious DLL that decrypts shellcode or an embedded backdoor module in memory. More recent variants introduced execution gating across exported functions so the malicious path is triggered only when the host application follows expected control flow, improving sandbox evasion.
The malware supports persistent remote access and modular post-compromise operations. Reported capabilities include command-and-control communications, host information gathering, configuration updates, plugin or component replacement, uninstall routines, proxy management, named-pipe creation, process creation, and code injection into newly created or existing processes. Variants have also been observed storing payloads or configuration data in the registry and using encrypted embedded configuration blocks containing command-and-control entries, mutexes, process names, and behavioral flags. Technical analyses describe encrypted and compressed payload handling, custom PE-like in-memory formats, anti-debugging and anti-sandbox checks, and plugin loading mechanisms consistent with long-term espionage tooling.
Operationally, SnappyBee is used as a stealthy foothold for sustained access in targeted intrusions. It has appeared alongside other China-linked implants and loaders, including ShadowPad-derived tooling, GhostSpider, ZingDoor, Terndoor, and generic shellcode loaders, indicating its role within a broader shared malware ecosystem rather than a single exclusive actor toolkit. Its repeated use in telecom and government-focused campaigns, as well as in energy-sector intrusions, is consistent with intelligence collection, persistence, and follow-on post-exploitation objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The process command line contained the MSExchangePowerShellAppPool argument, indicating that the attacker exploited the Exchange server via the ProxyNotShell exploit chain... ProxyNotShell (CVE-2022-41040, CVE-2022-41082) is a related exploit chain disclosed in 2022. Both allow unauthenticated attackers to execute code on unpatched Exchange servers. | Beyond the delivery mechanism, the operation is characterized by the deployment of two distinct backdoor families, Deed RAT and Terndoor, which were utilized across three separate waves of activity.
The operation deployed two distinct backdoor families, Deed RAT and Terndoor, across different stages.
In their latest campaign, the actor leverages one of the latest WinRAR vulnerabilities that will ultimately lead to running shellcode... Rule names: EE_Loader EE_Dropper WinRAR_ADS_Traversal References / Resources: WinRAR CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-8088
...exploited a public-facing Citrix NetScaler Gateway appliance, likely CVE-2023-3519, for initial access and deployed SnappyBee (also known as Deed RAT)... CVE-2023-3519 is a critical remote code execution (RCE) vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway appliances.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
しかし、私たちは調査の結果、BloodAlchemy は完全に新種のマルウェアではなく、ShadowPad の後継である DeedRAT のさらなる進化版であることを発見しました。
На серверах (за пределами сетевых устройств) Salt Typhoon разворачивает бэкдор GhostSpider (по данным Trend Micro, разработан специально для телеком-сетей), руткит Demodex (kernel-mode), Cobalt Strike, а также SnappyBee и HemiGate.
In one documented intrusion, the group also deployed SNAPPYBEE and ZingDoor together, a tactic independently highlighted by Trend Micro in 2024 reporting on similar China-linked activity.
...used for DLL side-loading in connection with Deed RAT (aka Snappybee) in prior activity attributed to Salt Typhoon...
...used for DLL side-loading in connection with Deed RAT (aka Snappybee) in prior activity attributed to Salt Typhoon...
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Despite remediation attempts, they repeatedly re-entered the network, deploying different backdoors in three distinct waves.
The chain of evidence includes Exchange exploitation (T1190 Exploit Public-Facing Application)... The process command line contained the MSExchangePowerShellAppPool argument, indicating that the attacker exploited the Exchange server via the ProxyNotShell exploit chain.
After opening an interactive remote session, they launched a PowerShell console (T1059.001 PowerShell), and within minutes, LMIGuardianSvc.exe and its associated files appeared on the system.
ShellManager — удаленная командная строка... Приложения MITRE: T1059.003 Command and Scripting Interpreter: Windows Command Shell
ВПО группы Space Pirates использует функции WinAPI для запуска новых процессов и внедрения шеллкода
In their latest campaign, the actor leverages one of the latest WinRAR vulnerabilities that will ultimately lead to running shellcode.
Annotations ID Technique Tactic T1559 Inter-Process Communication Execution
MITRE ATT&CK Mapping... T1569.002 Service Execution LogMeIn Hamachi service executes LMIGuardianSvc.exe at system startup.
"Unlike standard DLL side-loading that relies on simple file replacement, this method overrides two specific exported functions within the malicious library. This creates a two-stage trigger that gates the Deed RAT loader's execution through the host application's natural control flow..."
Deed RAT хранит в реестре все свои данные, включая конфигурацию и плагины
Despite remediation attempts, they repeatedly re-entered the network, deploying different backdoors in three distinct waves.
The recently observed intrusion... followed by web shell deployment, command execution, DLL sideloading, and backdoor deployment.
The third wave brought back a modified Deed RAT using sentinelonepro[.]com as its command-and-control address, impersonating a well-known security vendor to avoid detection in network logs.
При создании сервисов группа Space Pirates использует легитимно выглядящие имена
Группа Space Pirates маскирует свое ВПО под легитимное ПО
The recently observed intrusion... followed by web shell deployment, command execution, DLL sideloading, and backdoor deployment.
MITRE ATT&CK Mapping... T1140 Deobfuscate / Decode Files or Information RC4, AES-CBC, LZNT1, and Deflate decryption/decompression of Deed RAT components and plugins.
The payload only runs after the host application follows a specific internal sequence of calls, meaning a sandbox examining the file in isolation sees no malicious behavior at all.
"Unlike standard DLL side-loading that relies on simple file replacement, this method overrides two specific exported functions within the malicious library. This creates a two-stage trigger that gates the Deed RAT loader's execution through the host application's natural control flow..."
Группа Space Pirates собирает информацию о сетевых параметрах зараженной машины
Группа Space Pirates собирает информацию о пользователях скомпрометированных компьютеров
Deed RAT собирает информацию об используемых прокси с помощью прослушивания трафика
Сразу же после установки соединения с C2 бэкдор собирает и отправляет информацию о системе... Приложения MITRE: T1082
ВПО группы Space Pirates поддерживает работу с несколькими C2 и может обновлять список C2 через веб-страницы
MITRE ATT&CK Mapping... T1071.001 Application Layer Protocol HTTPS C2 to sentinelonepro[.]com:443 and virusblocker[.]it[.]com:443
RS5Manager — использование зараженного компьютера в качестве прокси-сервера... Deed RAT может обнаруживать и использовать прокси для соединения с C2
Группа Space Pirates загружает дополнительные утилиты с управляющего сервера посредством утилиты certutil
ВПО группы Space Pirates может сжимать сетевые сообщения с помощью алгоритмов LZNT1 и LZW
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware/backdoor in Salt Typhoon's server-side arsenal mentioned alongside GhostSpider, Demodex, and HemiGate.
Backdoor/RAT used by FamousSparrow in a multi-wave intrusion against an Azerbaijani oil and gas company. It was deployed via DLL sideloading using files disguised as LogMeIn Hamachi, with its payload stored in an encrypted file (.hamachi.lng), decrypted in memory using AES-128 and RC4, and persisted via a Windows service.
A remote access trojan/backdoor deployed by FamousSparrow during multiple waves of intrusion; described as a successor to ShadowPad and used to maintain access to the compromised network.
A backdoor/RAT described as a successor of ShadowPad, deployed in multiple waves during the intrusion to provide persistent access. The campaign used an evolved DLL side-loading technique leveraging the legitimate LogMeIn Hamachi binary to load a rogue DLL that executed the main payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.