10/20/25, 12:00 PM

According to Darktrace, Salt Typhoon—a China-linked cyber espionage group also tracked as Earth Estries, GhostEmperor and UNC2286—was observed targeting a European telecommunications organisation, with activity aligning to its known TTPs such as DLL sideloading and abuse of legitimate software. The intrusion likely began in the first week of July 2025 via exploitation of a Citrix NetScaler Gateway appliance, before pivoting to Citrix Virtual Delivery Agent hosts in the client’s MCS subnet.

The threat actor delivered a backdoor, assessed with high confidence as SNAPPYBEE (also known as Deed RAT), to multiple Citrix VDA hosts, embedded in DLLs alongside legitimate antivirus executables. Command-and-control leveraged LightNode VPS endpoints over HTTP and an unidentified TCP-based protocol, with one C2 host contacting aar.gandhibludtric[.]com.

Darktrace produced high-confidence detections and remediated the intrusion before it escalated, highlighting the value of anomaly-based detection alongside rapid containment, particularly when adversaries leverage legitimate tools to linger and exfiltrate data.