By Huseyin Can YUCEEL & Picus Labs August 22, 2022 Ransomware

Snatch ransomware is a stealthy malware that utilizes publicly available and built-in tools for its malicious activities. Since Windows does not often run endpoint protection mechanisms in Safe Mode, Snatch ransomware avoids detection by forcing infected hosts to reboot into Safe Mode. The Snatch ransomware group uses the double extortion method; accordingly, the payload is made of ransomware and data stealer components. Threat actors use automated brute-force attacks against vulnerable applications in the target organizations. Also, the Snatch ransomware operators also use their affiliate partners to gain initial access to corporate networks.

Metadata

Associated Groups	Affiliates - TA505
Associated Country	Russia
First Seen	December 2018
Target Countries	United Kingdom, United States

Modus Operandi

Business Models	Extortion Initial Access Brokers (IABs)
Extortion Tactics	File Encryption Data Leakage
Initial Access Methods	Phishing Valid Accounts
Impact Methods	Data Encryption Data Exfiltration

Utilized Tools and Malware by Snatch

MITRE ATT&CK Tactic	Tools
Initial Access	Metasploit Meterpreter
Execution	PsExec Cobalt Strike
Persistence	Reg.exe
Privilege Execution	dazzleUP PEASS-ng PowerUpSQL Watson
Defence Evasion	IOBit Uninstaller Process Hacker Bcdedit
Discovery	arp Ditsnap Advanced Port Scanner
Lateral Movement	PsExec
Exflitration	Update_Collector.exe
Impact	vssadmin Snatch Ransomware (abcdex64.exe)

[1] “Metasploit,” Metasploit. https://www.metasploit.com/ (accessed Jul. 06, 2022).
[2] “PsExec - Windows Sysinternals.” https://docs.microsoft.com/en-us/sysinternals/downloads/psexec (accessed Jul. 06, 2022).
[3] K. Arhart, “Cobalt Strike,” Cobalt Strike Research and Development, Aug. 19, 2021. https://www.cobaltstrike.com/ (accessed Jul. 06, 2022).
[4] S. Özarslan, “MITRE ATT&CK T1060 Registry Run Keys / Startup Folder.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1060-registry-run-keys-startup-folder (accessed Jul. 06, 2022).
[5] P. Hacker, “Process Hacker.” https://processhacker.sourceforge.io (accessed Jul. 06, 2022).
[6] H. C. Yüceel, “MITRE ATT&CK T1490 Inhibit System Recovery - The Ransomware’s Favorite.” https://www.picussecurity.com/resource/mitre-attck-t1490-inhibit-system-recovery-the-ransomwares-favorite (accessed Jul. 06, 2022).
[7] “arp(8) - Linux manual page.” [Online]. Available: https://man7.org/linux/man-pages/man8/arp.8.html. [Accessed: Jul. 07, 2022]
[8] “unixfreaxjp/ditsnap repository - Issues Antenna.” [Online]. Available: https://issueantenna.com/repo/unixfreaxjp/ditsnap. [Accessed: Jul. 07, 2022]
[9] “Advanced Port Scanner – free and fast port scanner.” https://www.advanced-port-scanner.com (accessed Jul. 06, 2022).
[10] A. Brandt, “Snatch ransomware reboots PCs into Safe Mode to bypass protection,” Sophos News, Dec. 09, 2019. [Online]. Available: https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/. [Accessed: Jul. 07, 2022]
[11] F. Fkie, “Snatch (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch. [Accessed: Jul. 07, 2022]

Snatch Ransomware Gang

Emerging Threat

Palo Alto CVE-2024-0012 and CVE-2024-9474 Vulnerabilities Explained

Emerging Threat

Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign

Emerging Threat

CVE-2024-47575: FortiManager Missing Authentication Zero-Day Vulnerability Explained

Emerging Threat

Iranian Cyber Actors’ Brute Force and Credential Access Attacks: CISA Alert AA24-290A

Emerging Threat

CISA Alert AA24-249A: Russian GRU Unit 29155 Targeting U.S. and Global Critical Infrastructure

Emerging Threat

CVE-2024-38063: Remote Kernel Exploitation via IPv6 in Windows

Emerging Threat

RansomHub Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA24-242A

Emerging Threat

Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks Against U.S. Organizations

Emerging Threat

Andariel: North Korean APT Group Targets Military and Nuclear Programs

Platform

I want to

Use Cases

Frameworks

RESEARCH

LEARNING

RESOURCES

LEARNING

COMPANY

PARTNERS

Snatch Ransomware Gang

Share this article:

Share this article:

Emerging Threat

Palo Alto CVE-2024-0012 and CVE-2024-9474 Vulnerabilities Explained

Emerging Threat

Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign

Emerging Threat

CVE-2024-47575: FortiManager Missing Authentication Zero-Day Vulnerability Explained

Emerging Threat

Iranian Cyber Actors’ Brute Force and Credential Access Attacks: CISA Alert AA24-290A

Emerging Threat

CISA Alert AA24-249A: Russian GRU Unit 29155 Targeting U.S. and Global Critical Infrastructure

Emerging Threat

CVE-2024-38063: Remote Kernel Exploitation via IPv6 in Windows

Emerging Threat

RansomHub Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA24-242A

Emerging Threat

Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks Against U.S. Organizations

Emerging Threat

Andariel: North Korean APT Group Targets Military and Nuclear Programs

Get the Latest InsightsDelivered Straight to Your Inbox

Get the Latest Insights
Delivered Straight to Your Inbox