Snatch ransomware hijacks PC safe mode
New ransomware strain leverages Windows Safe Mode to encrypt users' files
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A new strain of the Snatchransomwarehas been discovered that reboots the computers it infects into Safe Mode in order to bypass security solutions.
Dicovered by security researchers from the Sophos Managed Threat Response team and SophosLabs, the new strain makes infected Windows devices boot intoSafe Mode, allowing it to encrypt victim’s files since most security tools are automatically disabled when doing so.
Although the Snatch ransomware was written inGoogle’s multiplatformprogramming languageGo, the researchers explained in ablog postthat it can only run on Windows devices, saying:
“The malware we’ve observed isn’t capable of running on platforms other than Windows. Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions. The samples we’ve seen are also packed with the open source packer UPX to obfuscate their contents.”
The Snatch ransomware was released at the end of 2018 but it first became noticeably active during April of this year as a result of a spike in ransom notes and encrypted file samples which were submitted to Michael Gillepsie’sID Ransomwareplatform.
Snatch ransomware
In order to take advantage of the fact thatanti-malwaresolutions are not loaded in Safe Mode, the Snatch ransomware component installs itself as a Windows service called SuperBackupMan that has the ability to run in Safe Mode and also can’t be stopped or paused.
SuperBackupMan then force restarts the compromised machine and once it is in Safe Mode, the Snatch ransomware then deletes “all the Volume Shadow Copies on the system” according to the researchers which prevents “forensic recovery of the files encrypted by the ransomware”.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Now that recovery of the files without payment is impossible, the malware will then begin to encrypt its victims' files.
To prevent falling victim to the Snatch ransomware, Sophos recommends that organizations don’t expose their remote desktop services to the internet or try to protect them by using aVPN. The firm also suggests that businesses utilize multifactor authentication to protect admin accounts from brute force attacks.
ViaBleeping Computer
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
This new phishing strategy utilizes GitHub comments to distribute malware
Viltrox is changing the game for camera lenses, with its latest premium prime matching Sony’s best for half the price
