Report Details Changing Snatch TTPs, including Rebooting PCs into Safe Mode

OXFORD, U.K. — Dicembre 10, 2019 —

Sophos (LSE: SOPH), a global leader in next-generation cybersecurity,  today published an investigative report, Snatch Ransomware Reboots PCs into Safe Mode to Bypass Protection, by SophosLabs and Sophos Managed Threat Response. The report details the changing attack methods of Snatch ransomware, first seen in December 2018, including rebooting PCs into Safe Mode mid-attack in an attempt to bypass behavioral protections that detect ransomware activity. Sophos believes this is a new attack technique adopted by cybercriminals for defense evasion.

Continuing a trend noted in SophosLabs’ 2020 Threat Report, the Snatch cybercriminals are now also exfiltrating data before the ransomware attack begins. This behavior has been used by other ransomware groups, including Bitpaymer. Sophos expects this sequence of exfiltrating data before ransomware encryption to continue. Businesses needing to comply with GDPR, the upcoming California Consumer Privacy Act and other regulatory laws may need to notify data protection regulators if they are victims of Snatch.

Snatch is an example of an automated, active attack, also outlined in SophosLabs’ 2020 Threat Report. Once attackers gain access by abusing remote access services, they use hand-to-keyboard hacking to move laterally and do damage. As explained in the Snatch report, attackers are gaining entry through insecure IT remote access services, such as (but not limited to) Remote Desktop Protocol (RDP). The report shows examples of Snatch attackers recruiting potential collaborators who are skilled in compromising remote access services in dark web forums. Below is a screen shot of the dark web forum conversation in Russian, which states, “Looking for affiliate partners with access to RDP\VNC\TeamViewer\WebShell\SQLinj in corporate networks, stores and other companies."

Snatch ransomware

Advice for defenders:

  • Be proactive about threat hunting: use an expert internal or external security operations team to monitor for threats around the clock 
  • Enable machine/deep learning, active adversary mitigations and behavioral detection in endpoint security
  • Where possible, identify and shutdown remote access services exposed to the public internet
  • If remote access is required, use a VPN with industry best practice multi-factor authentication, password audits and precise access control, in addition to actively monitoring remote access
  • Any servers with remote access open to the public internet need to be up-to-date on patches and protected by preventative controls (such as endpoint protection software), and actively monitored for anomalous login and other abnormal behaviour
  • Users logged into remote access services should have limited privileges for the rest of the corporate network
  • Administrators should adopt multi-factor authentication and use a separate administrative account from their normal user account
  • Actively monitor for open RDP ports in public IP space

For additional information and in-depth technical details about Snatch ransomware, please reference SophosLabs Uncut.

Screen shots are available upon request.

Informazioni su Sophos

Sophos è un’azienda leader nell’ambito della cybersecurity e protegge 600.000 organizzazioni in tutto il mondo con una piattaforma basata sull’IA e servizi a cura di esperti. Sophos viene incontro alle esigenze delle organizzazioni, adattandosi al loro livello di maturità di sicurezza informatica e crescendo insieme ai clienti per tutelarli dai cyberattacchi. La sua soluzione offre la combinazione ottimale tra machine learning, automazione e dati di intelligence sulle minacce in tempo reale, aggiungendo le competenze umane degli esperti del team Sophos X-Ops, che lavorano in prima linea per garantire monitoraggio, rilevamento e risposta alle minacce 24/7.
Sophos offre un servizio di Managed Detection and Response (MDR) leader di settore, nonché una linea completa di tecnologie di sicurezza, tra cui soluzioni per la protezione di endpoint, rete, e-mail e cloud, nonché Extended Detection and Response (XDR), rilevamento delle minacce all’identità (Identity Threat Detection and Response, ITDR) e SIEM next-gen. Unite a servizi di consulenza a cura di esperti, queste funzionalità aiutano le organizzazioni a ridurre proattivamente il rischio e a rispondere in maniera più tempestiva, ottenendo il giusto livello di visibilità e scalabilità richiesto per tenersi un passo avanti rispetto a minacce in continua evoluzione.
La strategia go-to-market di Sophos si basa su un ecosistema di Partner che include Managed Service Provider (MSP), Managed Security Service Provider (MSSP), Rivenditori e Distributori, integrazioni per il marketplace, e Partner Cyber Risk; questa strategia offre alle organizzazioni la flessibilità di scegliere come stabilire rapporti di fiducia per la protezione della loro attività.  Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.