Snatch ransomware is a stealthy malware that utilizes publicly available and built-in tools for its malicious activities. Since Windows does not often run endpoint protection mechanisms in Safe Mode, Snatch ransomware avoids detection by forcing infected hosts to reboot into Safe Mode. The Snatch ransomware group uses the double extortion method; accordingly, the payload is made of ransomware and data stealer components. Threat actors use automated brute-force attacks against vulnerable applications in the target organizations. Also, the Snatch ransomware operators also use their affiliate partners to gain initial access to corporate networks.
Ransomware
Metadata
Associated Groups | Affiliates - TA505 |
Associated Country | Russia |
First Seen | December 2018 |
Target Countries | United Kingdom, United States |
Modus Operandi
Business Models | Extortion Initial Access Brokers (IABs) |
Extortion Tactics | File Encryption Data Leakage |
Initial Access Methods | Phishing Valid Accounts |
Impact Methods | Data Encryption Data Exfiltration |
Utilized Tools and Malware by Snatch
MITRE ATT&CK Tactic | Tools |
Initial Access | Metasploit Meterpreter |
Execution | PsExec Cobalt Strike |
Persistence | Reg.exe |
Privilege Execution | dazzleUP PEASS-ng PowerUpSQL Watson |
Defence Evasion | IOBit Uninstaller Process Hacker Bcdedit |
Discovery | arp Ditsnap Advanced Port Scanner |
Lateral Movement | PsExec |
Exflitration | Update_Collector.exe |
Impact | vssadmin Snatch Ransomware (abcdex64.exe) |
-3.png?width=734&height=464&name=image%20(61)-3.png)
