This archive report was first published on 10 December 2019.
Published on December 10, 2019, SophosLabs and Sophos Managed Threat Response reported that Snatch ransomware has adopted a new attack technique to evade detection.
Snatch cybercriminals now reboot PCs into Safe Mode mid-attack, a tactic that allows them to bypass behavioral protections that detect ransomware activity. This evolution in attack methods was first discovered in December 2018.
According to SophosLabs' 2020 Threat Report, Snatch cybercriminals are also exfiltrating data before the ransomware attack begins, a behavior previously seen in other ransomware groups, including Bitpaymer. This sequence of exfiltrating data before ransomware encryption is expected to continue, posing a significant threat to businesses.
Snatch is an example of an automated, active attack, where attackers gain access by abusing remote access services, such as Remote Desktop Protocol (RDP). Once inside, they use hand-to-keyboard hacking to move laterally and do damage. The report highlights the importance of secure remote access services, as attackers are recruiting potential collaborators who are skilled in compromising remote access services in dark web forums.
Advice for defenders includes being proactive about threat hunting, enabling machine/deep learning, active adversary mitigations, and behavioral detection in endpoint security. It is also essential to identify and shutdown remote access services exposed to the public internet, use a VPN with industry best practice multi-factor authentication, and actively monitor remote access.
For additional information and in-depth technical details about Snatch ransomware, please reference SophosLabs Uncut.
