Snatch Ransomware Gang

By Huseyin Can YUCEEL & Picus Labs August 22, 2022 Ransomware

Snatch ransomware is a stealthy malware that utilizes publicly available and built-in tools for its malicious activities. Since Windows does not often run endpoint protection mechanisms in Safe Mode, Snatch ransomware avoids detection by forcing infected hosts to reboot into Safe Mode. The Snatch ransomware group uses the double extortion method; accordingly, the payload is made of ransomware and data stealer components. Threat actors use automated brute-force attacks against vulnerable applications in the target organizations. Also, the Snatch ransomware operators also use their affiliate partners to gain initial access to corporate networks.

Metadata

Associated Groups	Affiliates - TA505
Associated Country	Russia
First Seen	December 2018
Target Countries	United Kingdom, United States

Modus Operandi

Business Models	Extortion Initial Access Brokers (IABs)
Extortion Tactics	File Encryption Data Leakage
Initial Access Methods	Phishing Valid Accounts
Impact Methods	Data Encryption Data Exfiltration

Utilized Tools and Malware by Snatch

MITRE ATT&CK Tactic	Tools
Initial Access	Metasploit Meterpreter
Execution	PsExec Cobalt Strike
Persistence	Reg.exe
Privilege Execution	dazzleUP PEASS-ng PowerUpSQL Watson
Defence Evasion	IOBit Uninstaller Process Hacker Bcdedit
Discovery	arp Ditsnap Advanced Port Scanner
Lateral Movement	PsExec
Exflitration	Update_Collector.exe
Impact	vssadmin Snatch Ransomware (abcdex64.exe)

[1] “Metasploit,” Metasploit. https://www.metasploit.com/ (accessed Jul. 06, 2022).
[2] “PsExec - Windows Sysinternals.” https://docs.microsoft.com/en-us/sysinternals/downloads/psexec (accessed Jul. 06, 2022).
[3] K. Arhart, “Cobalt Strike,” Cobalt Strike Research and Development, Aug. 19, 2021. https://www.cobaltstrike.com/ (accessed Jul. 06, 2022).
[4] S. Özarslan, “MITRE ATT&CK T1060 Registry Run Keys / Startup Folder.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1060-registry-run-keys-startup-folder (accessed Jul. 06, 2022).
[5] P. Hacker, “Process Hacker.” https://processhacker.sourceforge.io (accessed Jul. 06, 2022).
[6] H. C. Yüceel, “MITRE ATT&CK T1490 Inhibit System Recovery - The Ransomware’s Favorite.” https://www.picussecurity.com/resource/mitre-attck-t1490-inhibit-system-recovery-the-ransomwares-favorite (accessed Jul. 06, 2022).
[7] “arp(8) - Linux manual page.” [Online]. Available: https://man7.org/linux/man-pages/man8/arp.8.html. [Accessed: Jul. 07, 2022]
[8] “unixfreaxjp/ditsnap repository - Issues Antenna.” [Online]. Available: https://issueantenna.com/repo/unixfreaxjp/ditsnap. [Accessed: Jul. 07, 2022]
[9] “Advanced Port Scanner – free and fast port scanner.” https://www.advanced-port-scanner.com (accessed Jul. 06, 2022).
[10] A. Brandt, “Snatch ransomware reboots PCs into Safe Mode to bypass protection,” Sophos News, Dec. 09, 2019. [Online]. Available: https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/. [Accessed: Jul. 07, 2022]
[11] F. Fkie, “Snatch (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch. [Accessed: Jul. 07, 2022]

Snatch Ransomware Gang

Share this article:

Share this article:

Table of Contents

Get the Latest InsightsDelivered Straight to Your Inbox

Get the Latest Insights
Delivered Straight to Your Inbox