Snatch ransomware hijacks PC safe mode

(Image credit: Pixabay)
Audio player loading…

A new strain of the Snatch ransomware has been discovered that reboots the computers it infects into Safe Mode in order to bypass security solutions.

Dicovered by security researchers from the Sophos Managed Threat Response team and SophosLabs, the new strain makes infected Windows devices boot into Safe Mode, allowing it to encrypt victim's files since most security tools are automatically disabled when doing so.

Although the Snatch ransomware was written in Google's multiplatform programming language Go, the researchers explained in a blog post (opens in new tab) that it can only run on Windows devices, saying:

“The malware we’ve observed isn’t capable of running on platforms other than Windows. Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions. The samples we’ve seen are also packed with the open source packer UPX to obfuscate their contents.”

The Snatch ransomware was released at the end of 2018 but it first became noticeably active during April of this year as a result of a spike in ransom notes and encrypted file samples which were submitted to Michael Gillepsie's ID Ransomware (opens in new tab) platform.

Snatch ransomware

In order to take advantage of the fact that anti-malware solutions are not loaded in Safe Mode, the Snatch ransomware component installs itself as a Windows service called SuperBackupMan that has the ability to run in Safe Mode and also can't be stopped or paused.

SuperBackupMan then force restarts the compromised machine and once it is in Safe Mode, the Snatch ransomware then deletes “all the Volume Shadow Copies on the system” according to the researchers which prevents “forensic recovery of the files encrypted by the ransomware”.

Now that recovery of the files without payment is impossible, the malware will then begin to encrypt its victims' files.

To prevent falling victim to the Snatch ransomware, Sophos recommends that organizations don't expose their remote desktop services to the internet or try to protect them by using a VPN. The firm also suggests that businesses utilize multifactor authentication to protect admin accounts from brute force attacks.

Via Bleeping Computer (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.