Snow

SNOW is a tracked Maze ransomware affiliate associated with enterprise intrusions that culminate in Maze deployment and extortion. The actor has been linked to the Maze ecosystem’s corporate ransomware model, including file encryption combined with threats based on stolen data. Reporting also places SNOW within a broader eCrime overlap zone involving tooling, infrastructure, or operational relationships connected to Zloader, Gozi, and TrickBot. SNOW’s operations emphasize post-compromise tradecraft typical of mature ransomware affiliates. Observed activity includes initial access via exposed RDP, brute force activity, and SMB exploitation, followed by extensive reconnaissance, credential theft, privilege escalation, lateral movement, and persistence. The actor has used common offensive and red-team tooling including Cobalt Strike, Metasploit, Mimikatz, PowerShell, AdFind, Koadic, PowerShell Empire, and GMER. Reconnaissance has included account and privilege enumeration, Kerberos ticket inspection, domain group discovery, network share enumeration, and internal port scanning. Credential access has included Mimikatz-based dumping and pass-the-hash. Lateral movement has involved PsExec, SMB-based movement, exploitation of reachable systems, and reuse of compromised hosts to scan for additional internal or external targets. A notable operational characteristic is patience after initial foothold. When administrative privileges were not immediately available, SNOW reportedly maintained multiple backdoors, mapped the environment, and waited for higher-privileged users to authenticate before pivoting toward higher-value assets such as domain controllers and other critical servers. Infections were sometimes left dormant for several days before follow-on activity resumed. SNOW has also been associated with a custom Maze loader commonly referred to as DllCrypt. Reverse engineering of this loader showed in-memory decryption and loading of the Maze ransomware payload, along with anti-analysis or defensive checks. Additional reporting linked packed delivery of the loader to a crypter associated with TrickBot customers and identified overlaps with Gozi and Zloader through certificate-chain and loader-trait pivots. These overlaps reinforce the assessment that SNOW operated within a fluid criminal ecosystem where affiliates and service providers reused malware delivery components, crypters, and access pathways across major crimeware families. Observed victim organizations included law firms, distributors, and resellers, indicating a focus on corporate environments where disruptive encryption and data-theft extortion could generate leverage.