Darktrace Links Citrix Intrusion at European Telecom to Salt Typhoon
Summary
Darktrace reports that attackers exploited CVE-2025-5777 to access a European telecom, deployed the SNAPPYBEE backdoor through DLL sideloading, and used multiple C2 channels. The activity was detected and remediated early; attribution to Salt Typhoon is assessed with “/
Key points
- Attackers exploited CVE-2025-5777 on Citrix NetScaler Gateway appliances in early July 2025, then pivoted to Citrix VDA hosts.
- Darktrace assessed with high confidence that the attackers deployed SNAPPYBEE, also known as Deed RAT, to multiple internal hosts.
- The backdoor was delivered alongside legitimate antivirus software and executed through DLL sideloading.
- The activity used LightNode VPS endpoints for HTTP and an unidentified TCP-based command-and-control channel; Darktrace also identified a domain linked to Salt Typhoon reporting.
- Darktrace detected the intrusion in its early stages, and the activity was remediated before it escalated.
- Darktrace assessed with moderate confidence that the activity was consistent with Salt Typhoon, also tracked as Earth Estries, GhostEmperor, and UNC2286.
Article Details
- Attack Vectors
- Exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances for initial access.
- Pivoting from the initially compromised environment to Citrix Virtual Delivery Agent hosts in the client's Machine Creation Services subnet.
- DLL side-loading using legitimate antivirus executables to execute the SNAPPYBEE backdoor.
- Command-and-control over HTTP and an unidentified TCP-based protocol.
- Defensive Notes
- Darktrace reports that high-confidence detections identified early tooling and C2 activity, and that the intrusion was remediated before it escalated.
- The article recommends proactive, anomaly-based detection and correlation of behavioral signals alongside signature matching.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | aar[.]gandhibludtric[.]com | Hostname identified as a likely C2 server and linked to Salt Typhoon. |
| IPV4 | 156[.]244[.]28[.]153 | Possible C2 server. |
| IPV4 | 38[.]54[.]63[.]75 | IP address identified as a likely C2 server contacted by compromised endpoints. |
| IPV4 | 89[.]31[.]121[.]101 | Possible C2 server and host for likely SNAPPYBEE downloads and DLL side-loading files. |
| SHA1 | b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 | Hash identified as a likely SNAPPYBEE download. |
| URL | hxxp[:]//156[.]244[.]28[.]153/17ABE7F017ABE7F0 | URL associated with possible C2 activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443//Dialog[.]dat | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/1[.]txt | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/123[.]tar | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/123[.]txt | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/dbindex[.]dat | URL associated with likely DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/DgApi[.]dll | URL associated with likely DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/DisplayDialog[.]exe | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/fltLib[.]dll | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/imfsbDll[.]dll | URL associated with likely DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/imfsbSvc[.]exe | URL associated with likely DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/NortonLog[.]txt | URL associated with likely DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/pdc[.]exe | URL associated with possible DLL side-loading activity. |
| URL | hxxp[:]//89[.]31[.]121[.]101:443/WINMM[.]dll | Likely SNAPPYBEE download URL. |
MITRE ATT&CK
T1071.001 · Web ProtocolsThe backdoor used HTTP for C2, including POST requests.T1095 · Non-Application Layer ProtocolThe backdoor used an unidentified TCP-based protocol for C2.T1105 · Ingress Tool TransferThe backdoor was delivered to internal Citrix VDA hosts.T1190 · Exploit Public-Facing ApplicationCVE-2025-5777 was exploited against Citrix NetScaler Gateway appliances for initial access.T1571 · Non-Standard PortThe appendix describes unencrypted HTTP C2 traffic over port 443.T1574.001 · DLLThe SNAPPYBEE backdoor was executed through DLL side-loading with legitimate antivirus software.T1665 · Hide InfrastructureThe article identifies use of the SoftEther VPN service as infrastructure obfuscation; its appendix lists this technique for that use.
CVE
People
Threat Actors
Earth EstriesThe article identifies Earth Estries as another tracking name for Salt Typhoon.GhostEmperorThe article identifies GhostEmperor as another tracking name for Salt Typhoon.Salt TyphoonThe article assesses with moderate confidence that the observed intrusion activity was consistent with this group.UNC2286The article identifies UNC2286 as another tracking name for Salt Typhoon.
Malware
Deed RATthe threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these internal endpoints as a DLLSNAPPYBEEsubsequently observed the threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these
Vendors
Products
Bkav Antivirusas a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLLCitrix NetScaler GatewayThe intrusion began with exploitation of CVE-2025-5777, a vulnerability affecting Citrix NetScaler Gateway appliances, in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA)Citrix Virtual Delivery AgentGateway appliances, in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activitiesIObit Malware Fighterlegitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLL side-loading via legitimateMachine Creation ServicesFrom there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activities in the intrusion originated from an endpoint potentiallyNorton Antivirusinternal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker
Tools
LightNode VPSThe backdoor delivered by the threat actor leveraged LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol. This dual-channel setup is consistent with Salt Typhoon’s knownSoftEther VPNaccess activities in the intrusion originated from an endpoint potentially associated with the SoftEther VPN service, suggesting infrastructure obfuscation from the outset.
Countries
Industries
Energythreat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.Governmentexecuted a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.TechnologyEurope, the Middle East, and Africa (EMEA) where it has targeted telecoms, government entities, and technology firms. Its use of custom malware and exploitation of high-impact vulnerabilities (e.g., Ivanti,Telecommunicationsthis advanced persistent threat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.