A new strain of the Snatch ransomware has been discovered that reboots the computers it infects into Safe Mode in order to bypass security solutions.
Dicovered by security researchers from the Sophos Managed Threat Response team and SophosLabs, the new strain makes infected Windows devices boot into Safe Mode, allowing it to encrypt victim's files since most security tools are automatically disabled when doing so.
Although the Snatch ransomware was written in Google's multiplatform programming language Go, the researchers explained in a blog post that it can only run on Windows devices, saying:
“The malware we’ve observed isn’t capable of running on platforms other than Windows. Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions. The samples we’ve seen are also packed with the open source packer UPX to obfuscate their contents.”
- New ransomware spreads via SMS
- That 'new Windows 10 update' could be packed with ransomware
- Also check out the best free anti-ransomware software tools
The Snatch ransomware was released at the end of 2018 but it first became noticeably active during April of this year as a result of a spike in ransom notes and encrypted file samples which were submitted to Michael Gillepsie's ID Ransomware platform.
Snatch ransomware
In order to take advantage of the fact that anti-malware solutions are not loaded in Safe Mode, the Snatch ransomware component installs itself as a Windows service called SuperBackupMan that has the ability to run in Safe Mode and also can't be stopped or paused.
SuperBackupMan then force restarts the compromised machine and once it is in Safe Mode, the Snatch ransomware then deletes “all the Volume Shadow Copies on the system” according to the researchers which prevents “forensic recovery of the files encrypted by the ransomware”.
Now that recovery of the files without payment is impossible, the malware will then begin to encrypt its victims' files.
To prevent falling victim to the Snatch ransomware, Sophos recommends that organizations don't expose their remote desktop services to the internet or try to protect them by using a VPN. The firm also suggests that businesses utilize multifactor authentication to protect admin accounts from brute force attacks.
- We've also highlighted the best antivirus software
