Snatch Ransomware Reboots Windows in Safe Mode to Bypass Antivirus

Cybersecurity researchers have spotted a new variant of the Snatch ransomware that first reboots infected Windows computers into Safe Mode and only then encrypts victims' files to avoid antivirus detection.

Unlike traditional malware, the new Snatch ransomware chooses to run in Safe Mode because in the diagnostic mode Windows operating system starts with a minimal set of drivers and services without loading most of the third-party startup programs, including antivirus software.

Snatch has been active since at least the summer of 2018, but SophosLabs researchers spotted the Safe Mode enhancement to this ransomware strain only in recent cyber attacks against various entities they investigated.

"SophosLabs researchers have been investigating an ongoing series of ransomware attacks in which the ransomware executable forces the Windows machine to reboot into Safe Mode before beginning the encryption process," the researchers say.

"The ransomware, which calls itself Snatch, sets itself up as a service [called SuperBackupMan with the help of Windows registry] that will run during a Safe Mode boot."

"When the computer comes back up after the reboot, this time in Safe Mode, the malware uses the Windows component net.exe to halt the SuperBackupMan service, and then uses the Windows component vssadmin.exe to delete all the Volume Shadow Copies on the system, which prevents forensic recovery of the files encrypted by the ransomware."

What makes Snatch different and dangerous from others is that in addition to ransomware, it's also a data stealer. Snatch includes a sophisticated data-stealing module, allowing attackers to steal vast amounts of information from the target organizations.

Though Snatch is written in Go, a programming language known for cross-platform app development, the authors have designed this ransomware to run only on the Windows platform.

"Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions. The samples we've seen are also packed with the open source packer UPX to obfuscate their contents," the researchers say.

Besides this, the attackers behind Snatch ransomware also offer partnership opportunities to other cybercriminals and rogue employees who possess credentials and backdoors into large organizations and can exploit it to deploy the ransomware.

As shown in the screenshot taken from an underground forum, one of the group members posted an offer "looking for affiliate partners with access to RDP \ VNC \ TeamViewer \ WebShell \ SQL injection in corporate networks, stores, and other companies."

Using brute-forced or stolen credentials, attackers first gain access to the company's internal network and then run several legitimate system administrators and penetration testing tools to compromise devices within the same network without raising any red flag.

"We also found a range of otherwise legitimate tools that have been adopted by criminals installed on machines within the target's network, including Process Hacker, IObit Uninstaller, PowerTool, and PsExec. The attackers typically use them to try to disable AV products," the researchers say.

Coveware, a company that specializes in extortion negotiations between attackers and ransomware victims, told Sophos that they negotiated with the Snatch criminals "on 12 occasions between July and October 2019 on behalf of their clients" with the ransom payments ranging between $2,000 to $35,000 in bitcoins.

To prevent ransomware attacks, organizations are recommended not to expose their critical services and secure ports to the public Internet, and if required, secure them using a strong password with multi-factor authentication.