Friday, June 21, 2024

Beware!! Snatch Ransomware Reboots PC in Safe Mode to Encrypt Files and Avoid Detection

The Snatch Ransomware was first identified in the year 2018 and now it adopts a new technique that involves forcing the windows machine to reboot in safe mode for performing the encryption process.

The ransomware encrypts the personal documents on the victim’s computer and appends Snatch extension to the encrypted files. Then it displays a ransom note asking victims to make payment in Bitcoin’s to unlock the files.

Snatch Ransomware Infection

The ransomware was distributed through spam emails and by compromising the open Remote Desktop Services (RDP) ports. It affects all the versions of Windows operating systems that include Windows 7, Windows 8.1 and Windows 10.

Sophos observed a new Snatch Ransomware campaign that infects the victim machine, but it doesn’t start to encrypt the files, instead, it adds a windows registry key to safe boot the machine.

The attackers also install Advanced Port Scanner to find additional machines connected with the target network and Windows service called SuperBackupMan, the service has capabilities of stopping user action while it is running.


Once the machine booted in safe mode the ransomware uses net.exe to halt the SuperBackupMan service and then delete all the Volume Shadow Copies on the system using vssadmin.exe components.

Then the ransomware starts the encryption process on the computer’s local hard drive and it won’t encrypt any of the system files to maintain the system stability.

Ransom Note

Upon successful encryption, it appends a pseudorandom string of five alphanumeric characters to the encrypted files and it gives ransomware notes unique to each targeted organization. The Ransom demands vary between $2,000 to $35,000.

The ransomware attack also abuses the following legitimate tools that include Process Hacker, IObit Uninstaller, PowerTool, and PsExec to disable the AV protection.

Ransomware Authors Seeking For Partners

The threat actors behind the ransomware posted on underground forums that they are looking for an automated active attack model for that they seek partnership with other cybercriminal gangs.

Sophos observed that a message board posting titled “Snatch ransomware” and the author is looking for “affiliate partners with access to RDP\VNC\TeamViewer\WebShell\SQL inj [SQL injection] in corporate networks, stores, and other companies.”

In one of the incidents observed by Sophos the attackers “accessed the company’s internal network by brute-forcing the password to an administrator’s account on a Microsoft Azure server, and were able to log in to the server using Remote Desktop (RDP).”

The bad news is that there is no decryptor available for the Snatch ransomware. It is always recommended to backup the data to prepare for these kinds of situations.

There are ways to prevent ransomware and protect yourself. In this article you will find straight-forward expert tips, so you never become a victim of Ransomware Attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles