Snatch

Snatch, also known as Snatch Team, is a financially motivated ransomware and data-extortion operation active since at least 2018. The group conducts opportunistic enterprise intrusions, principally targeting Windows environments, and has affected organizations in the United States, Canada, and Europe. It has also used Linux ransomware variants in attacks. Snatch operators commonly obtain initial access by brute-forcing or otherwise abusing exposed remote-access services, including RDP, and have sought affiliates with existing access through remote-management services, web shells, or SQL injection. Following access, they conduct extended reconnaissance, enumerate systems and users, steal credentials including LSASS memory contents, deploy remote-control or surveillance tooling, scan internal networks, move laterally, and exfiltrate victim data before ransomware deployment. They have used Cobalt Strike, PsExec, and legitimate administrative or security tools to facilitate post-exploitation activity and impair endpoint protections. A defining Snatch technique is rebooting compromised Windows systems into Safe Mode so that security products may not load. The ransomware establishes a service capable of operating in Safe Mode, alters boot configuration, deletes Volume Shadow Copies, and encrypts accessible files after the reboot. Snatch payloads have been observed packed with UPX and written in Go. Snatch was an early adopter of public victim naming and data-leak extortion. Its operations employ double extortion: encrypting files while threatening to release stolen data through a dedicated leak site if victims do not pay. The group has publicly represented itself as Snatch Team and has exhibited affiliate-oriented recruitment activity. Reports of overlap between Snatch and other extortion operations' victim postings suggest possible ecosystem-level collaboration or reuse of stolen data, but a definitive operational relationship is not established.