LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1086: Snip3

MITRE ATT&CK S1086: Snip3 Malware details for Windows, with detection guidance, relationships and mapped CVEs.

EnterpriseS1086MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Snip3 matters because it is described by ATT&CK as a Windows crypter-as-a-service used to obfuscate and load multiple commodity RAT families, including AsyncRAT, Revenge RAT, Agent Tesla, and NETWIRE. For leaders, the risk is not only one malware name; it is the defensive gap created when loaders, obfuscation, user-driven execution, and multi-stage command-and-control allow familiar malware to bypass static controls.

Executive priority

Prioritize Snip3 as a control-validation use case for phishing resilience, Windows endpoint visibility, script/WMI governance, and egress monitoring. The relationship to TA2541, a group described as targeting aviation, aerospace, transportation, manufacturing, and defense with high-volume commodity RAT campaigns, makes this especially relevant for organizations where remote access malware could affect business continuity, regulated operations, or cyber-physical risk. Budget and audit conversations should focus on whether controls detect the behavior chain, not whether a known hash is blocked.

Technical view

ATT&CK provides no official detection text for Snip3, so SOC and detection teams should validate coverage against the related techniques: obfuscated files and binary padding, PowerShell and Visual Basic execution, WMI execution, process hollowing, system and time-based anti-analysis checks, deobfuscation, Run Key/Startup Folder persistence, hidden windows, ingress tool transfer, web-service C2, multi-stage channels, drive-by compromise, malicious links/files, and spearphishing links/attachments. Treat Snip3 as a loader/crypter behavior cluster on Windows and correlate initial email or web activity with script execution, suspicious process ancestry, persistence creation, payload download, and outbound web-service communications.

Likely telemetry

  • Email security and mail gateway records for spearphishing attachments and links
  • Web proxy, DNS, and secure web gateway logs for malicious links, drive-by activity, downloads, and outbound web-service C2
  • Windows process creation telemetry, including parent-child relationships for script interpreters, WMI, and spawned payloads
  • PowerShell logging and command-line telemetry where enabled
  • WMI activity logs and endpoint management telemetry

Detection direction

  • Build detections around behavior chains rather than single indicators: phishing or web delivery followed by script/WMI execution, deobfuscation, process hollowing, persistence, and outbound C2.
  • Validate that Windows telemetry captures command lines, script content where appropriate, registry changes, file writes, and process ancestry; missing any of these can make loader activity appear as isolated benign events.
  • Tune PowerShell, Visual Basic, WMI, and hidden-window detections against legitimate administrative activity to reduce false positives without suppressing rare or risky combinations.
  • Review file-size limits and static-scanning assumptions because binary padding and obfuscation can weaken hash-based or size-limited controls.
  • Account for sandbox blind spots: system checks and time-based checks may cause samples to alter behavior during automated analysis.

Mitigation priorities

  • Strengthen phishing and web-delivery controls first: attachment/link inspection, browser and document handling policy, and user reporting workflows for malicious files and links.
  • Harden Windows execution paths used in the related techniques, including script interpreter governance, PowerShell controls, WMI monitoring, and least-privilege administration.
  • Monitor and restrict persistence mechanisms such as Registry Run Keys and Startup Folder entries where operationally feasible.
  • Ensure endpoint controls can inspect or alert on obfuscation, process hollowing, suspicious child processes, and staged payload downloads rather than relying only on known hashes.
  • Improve outbound control and monitoring for unusual web-service use, multi-stage C2 patterns, and ingress tool transfer.
Additional notes and limits

This take is based on ATT&CK S1086 for Snip3, its cited external references, and supplied relationships. The most decision-useful context is that Snip3 is a crypter/loader associated with obfuscation and delivery of multiple RAT families, with relationships spanning phishing, user execution, Windows scripting/WMI, stealth, persistence, and command-and-control behaviors.

ATT&CK does not provide official detection guidance for Snip3, and the object lists no explicit tactics. The malware platform is Windows, while some related techniques list broader platforms; platform-specific conclusions should therefore be limited to the supplied Snip3 platform and validated locally. No claim is made that any organization is exposed or that any detection is guaranteed.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Snip3

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or InformationThis object uses Deobfuscate/Decode Files or Information.
EnterpriseT1102Web ServiceThis object uses Web Service.
EnterpriseT1059.005Visual BasicSub-techniqueThis object uses Visual Basic.
EnterpriseT1055.012Process HollowingSub-techniqueThis object uses Process Hollowing.
EnterpriseT1027Obfuscated Files or InformationThis object uses Obfuscated Files or Information.
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-techniqueThis object uses Registry Run Keys / Startup Folder.
EnterpriseT1204.002Malicious FileSub-techniqueThis object uses Malicious File.
EnterpriseT1082System Information DiscoveryThis object uses System Information Discovery.
EnterpriseT1204.001Malicious LinkSub-techniqueThis object uses Malicious Link.
EnterpriseT1566.001Spearphishing AttachmentSub-techniqueThis object uses Spearphishing Attachment.
EnterpriseT1497.003Time Based ChecksSub-techniqueThis object uses Time Based Checks.
EnterpriseT1047Windows Management InstrumentationThis object uses Windows Management Instrumentation.
EnterpriseT1104Multi-Stage ChannelsThis object uses Multi-Stage Channels.
EnterpriseT1105Ingress Tool TransferThis object uses Ingress Tool Transfer.
EnterpriseT1566.002Spearphishing LinkSub-techniqueThis object uses Spearphishing Link.
EnterpriseT1189Drive-by CompromiseThis object uses Drive-by Compromise.
EnterpriseT1497.001System ChecksSub-techniqueThis object uses System Checks.
EnterpriseT1564.003Hidden WindowSub-techniqueThis object uses Hidden Window.
EnterpriseT1027.001Binary PaddingSub-techniqueThis object uses Binary Padding.
EnterpriseT1059.001PowerShellSub-techniqueThis object uses PowerShell.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · GroupG1018: TA2541Enterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1104: Multi-Stage ChannelsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1027.001: Binary PaddingEnterpriseuses · TechniqueT1059.001: PowerShellEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
8844fd55311e110b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle8844fd55311e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  2. [2]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  3. [3]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  4. [4]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  5. [5]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  6. [6]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  7. [7]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  8. [8]
    mitre-attackS1086
    Open source URL
  9. [9]
    mitre-attackS1086
    Open source URL
  10. [10]
    mitre-attackS1086
    Open source URL
  11. [11]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  12. [12]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  13. [13]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  14. [14]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  15. [15]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  16. [16]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  17. [17]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  18. [18]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  19. [19]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  20. [20]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  21. [21]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  22. [22]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  23. [23]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  24. [24]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  25. [25]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  26. [26]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  27. [27]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  28. [28]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  29. [29]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  30. [30]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  31. [31]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  32. [32]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  33. [33]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  34. [34]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  35. [35]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  36. [36]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  37. [37]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  38. [38]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  39. [39]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  40. [40]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  41. [41]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  42. [42]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  43. [43]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  44. [44]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  45. [45]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  46. [46]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  47. [47]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  48. [48]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  49. [49]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  50. [50]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  51. [51]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  52. [52]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  53. [53]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  54. [54]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  55. [55]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  56. [56]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  57. [57]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  58. [58]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  59. [59]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  60. [60]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  61. [61]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use