Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network

A European telecommunications organisation has reportedly been targeted by Salt Typhoon, a China-nexus cyber espionage group also known as Earth Estries, FamousSparrow, GhostEmperor and UNC5807, according to The Hacker News and Darktrace. The intrusion occurred in the first week of July 2025, with attackers gaining initial access by exploiting a Citrix NetScaler Gateway appliance, according to Darktrace.

One malware family delivered was Snappybee (aka Deed RAT), described as a suspected successor to ShadowPad, and it was launched using DLL side-loading alongside legitimate antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. The attackers then pivoted to Citrix Virtual Delivery Agent hosts in the client’s Machine Creation Services subnet and used SoftEther VPN to obscure their origins, while Snappybee attempted to contact an external server via HTTP to receive payloads.

Darktrace noted that the backdoor was delivered as a DLL alongside legitimate software and that the intrusion was identified and remediated before escalation. The report also emphasises Salt Typhoon’s persistence, its use of trusted tools, and its history of operations across multiple countries.