Saturday, March 2, 2024

Beware!! Snatch Ransomware Reboots PC in Safe Mode to Encrypt Files and Avoid Detection

The Snatch Ransomware was first identified in the year 2018 and now it adopts a new technique that involves forcing the windows machine to reboot in safe mode for performing the encryption process.

The ransomware encrypts the personal documents on the victim’s computer and appends Snatch extension to the encrypted files. Then it displays a ransom note asking victims to make payment in Bitcoin’s to unlock the files.

Snatch Ransomware Infection

The ransomware was distributed through spam emails and by compromising the open Remote Desktop Services (RDP) ports. It affects all the versions of Windows operating systems that include Windows 7, Windows 8.1 and Windows 10.

Sophos observed a new Snatch Ransomware campaign that infects the victim machine, but it doesn’t start to encrypt the files, instead, it adds a windows registry key to safe boot the machine.

The attackers also install Advanced Port Scanner to find additional machines connected with the target network and Windows service called SuperBackupMan, the service has capabilities of stopping user action while it is running.


Once the machine booted in safe mode the ransomware uses net.exe to halt the SuperBackupMan service and then delete all the Volume Shadow Copies on the system using vssadmin.exe components.

Then the ransomware starts the encryption process on the computer’s local hard drive and it won’t encrypt any of the system files to maintain the system stability.

Ransom Note

Upon successful encryption, it appends a pseudorandom string of five alphanumeric characters to the encrypted files and it gives ransomware notes unique to each targeted organization. The Ransom demands vary between $2,000 to $35,000.

The ransomware attack also abuses the following legitimate tools that include Process Hacker, IObit Uninstaller, PowerTool, and PsExec to disable the AV protection.

Ransomware Authors Seeking For Partners

The threat actors behind the ransomware posted on underground forums that they are looking for an automated active attack model for that they seek partnership with other cybercriminal gangs.

Sophos observed that a message board posting titled “Snatch ransomware” and the author is looking for “affiliate partners with access to RDP\VNC\TeamViewer\WebShell\SQL inj [SQL injection] in corporate networks, stores, and other companies.”

In one of the incidents observed by Sophos the attackers “accessed the company’s internal network by brute-forcing the password to an administrator’s account on a Microsoft Azure server, and were able to log in to the server using Remote Desktop (RDP).”

The bad news is that there is no decryptor available for the Snatch ransomware. It is always recommended to backup the data to prepare for these kinds of situations.

There are ways to prevent ransomware and protect yourself. In this article you will find straight-forward expert tips, so you never become a victim of Ransomware Attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles