Categories: Ad Guardian PlusNews

Snatch reboots Windows to bypass antivirus

Cybersecurity experts discovered a new version of the Snatch ransomware. This reboots infected Windows computers into Safe Mode. Then, it encrypts victims’ files to avoid antivirus detection.

In the diagnostic mode, Windows starts with a minimal set of drivers and services. The antivirus software and other thirt-party startup programs do not load in this mode. Thus, Snatch takes advantage of this.

SophosLabs researchers discovered the Safe Mode in the recent cyber attacks. Still, Snatch has been active since 2018.

According to SophosLabs, “Researchers have been investigating an ongoing series of ransomware attacks in which the ransomware executable forces the Windows machine to reboot into Safe Mode before beginning the encryption process. When the computer comes back up after the reboot, this time in Safe Mode, the malware uses the Windows component net.exe to halt the SuperBackupMan service, and then uses the Windows component vssadmin.exe to delete all the Volume Shadow Copies on the system, which prevents forensic recovery of the files encrypted by the ransomware.”

Snatch is also a data stealer

But the ransomware is also a data stealer. It includes a sophisticated data-stealing module which allows attackers obtain sensitive information.

“Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions. The samples we’ve seen are also packed with the open source packer UPX to obfuscate their contents,” the researchers say.

The attackers also offer partnership to other cybercriminals or mischievous employees that can access credentials and backdoors of important companies. One of the group members posted an offer “looking for affiliate partners with access to RDP \ VNC \ TeamViewer \ WebShell \ SQL injection in corporate networks, stores, and other companies.”

Using the stolen credentials, attackers gain access to the company’s internal network. Then, they run several legitimate system administrators and penetration testing tools to compromise devices. This way, they do not raise any red flag.

“We also found a range of otherwise legitimate tools that have been adopted by criminals installed on machines within the target’s network, including Process Hacker, IObit Uninstaller, PowerTool, and PsExec. The attackers typically use them to try to disable AV products,” the researchers say.

In order to avoid this kind of attacks, organizations should never expose their critical services and secure ports to the public Internet. Also, they should secure them by using strong passwords with multi-factor authentication.

Laurentiu Titei

View Comments

Recent Posts

Best Free PDF to JPG Converter to Use Online in 2025

While PDF is among the most secure file formats available, sometimes it becomes inevitable that…

17 hours ago

Best Screen Recording Software for PC

This article will be your favorite read of the day if you are a marketer,…

17 hours ago

Best Software Deployment Strategies to Use in 2025

If you wish to deploy a new software, then this article lists and explains some…

2 days ago

Apple Mobile Device USB Driver Download and Install in Windows 11/10

If you wish to proceed with the methods to Apple Mobile Device USB driver download,…

3 days ago

Best Methods to Activate Flash in Google Chrome in 2025

If you wish to activate Flash in Chrome, you can take the help of this…

4 days ago

Download SCR3310 Driver for Windows 11 and 10

Let’s have a look at some of the best methods to execute the SCR3310 driver…

6 days ago