Snatch Ransomware

A Snatch ransomware attack typically enters a system through one of the following methods:

• Exposed Remote Desktop Protocol (RDP) services

• Weak or reused credentials

Once access is gained, attackers deploy a ransomware payload that is specifically designed to evade antivirus software, often by forcing the system to reboot into Safe Mode, where many defences are disabled. This technique not only facilitates encryption but can also inhibit system recovery by disabling security tools and targeting backup mechanisms.

In some cases, attackers exploit known vulnerabilities that have not yet been patched, underlining the importance of timely system maintenance.

The Infrastructure Security Agency and other cyber defence bodies recommend adopting strong preventative policies, including:

• Educating staff on the importance of cyber security

• Enforcing the use of strong, unique passwords

• Implementing multi-factor authentication

• Removing unused or outdated user accounts

• Performing regular, secure backups

• Applying timely updates to all software and systems

• Configuring systems to log RDP login attempts for early detection of brute-force or unauthorised access attempts

• Protecting administrator credentials by limiting their use and applying least-privilege principles

• Verifying the source and behaviour of any legitimate file before executing it, as Snatch and other ransomware may disguise malicious payloads as normal files

After recovering from a Snatch incident, Zensec strongly recommends updating your business continuity plan to reflect lessons learnt from the attack and recovery process.

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

Even with controls in place, recovery planning is essential. Snatch can inhibit system recovery by corrupting or encrypting backups, rendering them useless. To mitigate this, organisations should maintain offline, immutable backups and test them regularly to ensure integrity.

A robust business continuity plan must also account for ransomware operations that involve data exfiltration and the threat of exposure on a ransomware blog involving Snatch or other ransomware operators. These tactics are designed to apply additional pressure on victims, even if security software successfully detects or halts parts of the attack.

Yes. There's a possibility that some of the lost data contains "Personal Data" belonging to your customers. Safeguarding such data is a legal requirement, so it's important to consider notifying the Information Commissioner's Office (ICO) about this incident, as well as your customers. https://ico.org.uk/

Your insurer or legal counsel will provide guidance on the necessary steps and how to proceed in this matter. However, Zensec has experience collaborating with insurers and legal representatives and can offer assistance in managing these relationships during this challenging period.