Snatch

Management summary

Snatch is an adult ransomware-as-a-service operation that has been visible since 2018 according to FBI and CISA. The group is especially dangerous for organizations because the attack often starts with recognizable, preventable weaknesses: RDP, brute-force, purchased credentials, administrator accounts and poor monitoring.

According to public advisories, the actor may be present in a network for longer periods of time before encryption takes place. This means that an organization that only watches ransomware payloads is late. The renowned phase is much earlier: remote logins, lateral movement, service changes, credential usage, data discovery and attempts to circumvent security.

The distinctive element is Safe Mode. Snatch is known to restart in Windows Safe Mode to make security tools less effective before encryption is performed. Organizations that do not monitor boot configuration and unexpected rebooting miss an important signal.

Grouping and development

Snatch is described by FBI and CISA as RaaS model. Affiliates perform intruders while the brand, infrastructure and extortion method support the pressure on victims. The group is also linked to Team Truniger in public reporting.

Snatch combines encryption with data diode. Victims can be pressured through publication claims and direct communication. In some cases, the group may use stolen data from previous or other incidents to increase pressure, which means that attribution of data must always be done carefully.

The development of Snatch shows that old attack paths are still working. RDP, weak credentials, administrator rights and missing logging are not a new problem but remain sufficient to cause severe ransomware impact.

Operation and attack chain

Initial access is often done via RDP or valid credentials. Brute-force, credential stuffing or purchased access can play a role in this. After access the actor tries to obtain privileges, explore systems and move laterally through normal management protocols.

During dwell time, Snatch can search data, explore security tools, customize services and prepare staging. Signals include RDP- sessions between servers, use of sc.exe, new services, Metasploit or Cobalt Strike activity, registry changes, account adjustments and data movement.

The Safe Mode step is crucial. By starting systems in Safe Mode, certain security components may not run or be limited. Afterwards, the encryption device can run with less resistance. Detection should therefore look at bcdedit, boot configuration, unexpected Safe Mode reboot and security services that do not occur.

After encryption, Snatch ransom notes and files can get a different extension. These artifacts confirm impact but are not the first moment in which defense was possible. The real gain is in stopping remote access and lateral movement.

Known IOCs and artifacts

FBI /CISA name filenames such as safe.exe or variants, ransom noteHOW TO RESTORE YOUR FILES .TXT , Safe Mode restarts, service manipulation with sc.exe, use post-exploitation tooling and attempts to remove volume shadow copies.

Not only do you search for safe.exe. New samples can use other names. Detect process behavior, parent-child relationships, command-lines, write bursts to many files, service stops and boot configuration in the same timeline as RDP- activity.

RDP-logs, Windows Security Events, EDR-telemetry, firewalllogs, VPN-logs and domain controller events are necessary to understand Snatch. Without those layers only the encryption damage remains visible.

Victim pattern and lessons

FBI and CISA include sectors such as Defense Industrial Base, Food and Agriculture and Information Technology. This image fits with an opportunistic but business-oriented RaaS operation: usable access and extortion value are decisive.

The main lesson is that long-term presence should be visible. If an actor can move through RDP and management protocols for weeks or months, there are no baselines, correlation or monitoring of alerts.

A second lesson is that Safe Mode should not be treated as a normal technical detail. Unexpected Safe Mode activity on servers is a high signal and needs to be investigated immediately.

How to arm yourself

Close RDP from the internet and limit internal RDP to jump hosts and management networks. Use MFA, device compliance, lockout policy and monitoring for failed and successful logins from unusual locations.

Detect Safe Mode abuse. Alert bcdedit, registry changes around boat, unexpected reboot, security services that stop and systems that start outside channelers in Safe Mode.

Protect backups and shadow copies. Monitor vssadmin, wbadmin, bcdedit, service stops and access to backup software. Restorers should remain out of reach of compromised domain accounts.

Identity, naming and attribution

For Snatch, the operational starting point is an exact identity match. The local dossier records the following names or aliases: Snatch ransomware, Team Truniger. An alias is a search aid, not independent evidence of shared operators. Similar names, reused logos and the same extortion vocabulary cannot establish a relationship between groups. Analysts should retain the original spelling of a claim and distinguish the publisher, malware family and suspected intrusion operator. Those roles can belong to different people. This prevents an incident being assigned to the wrong group simply because a filename or public post resembles an earlier case. Any proposed relationship needs its own dated, attributable source.

Indicators of compromise (IOCs)

Indicators are historical observations, not proof of a current infection. Validate source, age and context before hunting or blocking; legitimate administrative tools can produce false positives.

Sources

• CISA #StopRansomware: Snatch Ransomware
• MITRE ATT&CK — Valid Accounts (defensive context)
• MITRE ATT&CK — External Remote Services (defensive context)
• MITRE ATT&CK — Exfiltration Over Web Service (defensive context)
• MITRE ATT&CK — Inhibit System Recovery (defensive context)
• Ransomware.live — Snatch

Evidence and limitations

Attribution describes the source assessment, not a verified identity. A leak-site listing alone does not prove encryption, data theft, a particular vulnerability or an affiliate relationship. Missing information is left explicit.