Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor

### Executive summary Darktrace's analysis dissects SnappyBee (Deed RAT), a modular backdoor linked to Salt Typhoon, highlighting its post-compromise persistence and stealth techniques — including custom packing, DLL side-loading, dynamic API resolution, in-memory ARC4 decryption (mbedtls), and hooking of legitimate executables — and warns that it is used to deploy additional tools such as Cobalt Strike and the Demodex rootkit, underscoring the need for manual unpacking, dynamic debugging, and behavior-based detection.