Loading story…
Sophos reported that the Snatch ransomware operators are compromising Windows environments and rebooting infected machines into Safe Mode before encrypting files, a tactic designed to bypass many security products that do not run in that state. The malware installs itself as a Windows service named SuperBackupMan, alters Safe Mode boot settings, deletes Volume Shadow Copies, and encrypts data with a victim-specific five-character file extension.
Investigated intrusions showed the attackers gaining initial access by brute-forcing exposed remote services such as RDP, then moving laterally across enterprise networks, conducting reconnaissance, stealing data, and deploying tools including Cobalt Strike, custom malware, and legitimate administrative utilities. Sophos linked the activity to the self-described "Snatch Team" and cited signs of affiliate-style recruitment on Russian-language criminal forums, while incident data from Coveware indicated at least 12 negotiations over several months with ransom demands ranging from $2,000 to $35,000 in Bitcoin against organizations in the United States, Canada, and parts of Europe.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos reported that the Snatch operators appeared to have been active since summer 2018. The report also said Sophos first encountered Snatch about a year before this publication.
Sophos published research describing Snatch ransomware's use of a Windows reboot into Safe Mode before encrypting files, a capability it assessed as newly added. The report also linked the activity to the self-described 'Snatch Team' and noted opportunistic attacks against organizations in the United States, Canada, and several European countries.
Sophos investigated a ransomware outbreak at a targeted organization in mid-October involving Snatch. In that incident, the attackers had brute-forced an administrator account on a Microsoft Azure server, moved to a domain controller, conducted weeks of reconnaissance, and deployed surveillance tooling across about 200 machines.
Coveware told Sophos it had negotiated with the Snatch actors 12 times between July and October. Reported ransom demands ranged from $2,000 to $35,000 in Bitcoin.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcembsd.jp
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **Snatch** ransomware uses an unusual execution method on Windows systems by forcing infected PCs to reboot into **Safe Mode** before encrypting files. Because many endpoint protection tools and security services do not fully load in Safe Mode, the technique can let the malware run with reduced interference and improve the attackers' chances of completing encryption. The tactic highlights a deliberate defense-evasion approach rather than a conventional ransomware deployment alone. By abusing a legitimate Windows recovery feature, Snatch can disable or sidestep protections that would normally detect or block malicious activity, increasing operational impact on affected organizations and complicating incident response and containment.
Jun 29, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Play/PlayCrypt ransomware operators have used a repeatable double-extortion workflow beginning with compromised administrator credentials and RDP access. In two examined intrusions, the actors manually identified valuable data, archived it with WinRAR using the distinctive `-ep1 -scul -r0` options, and exfiltrated it through WinSCP. One operation was disrupted before encryption but continued data theft after defenders disabled an account; another reached encryption on more than 15 systems within roughly six hours, using PsExec to deploy distinct ransomware payloads from `C:\Users\Public\Music\`, disabling Windows protections, and deleting shadow copies. The group, active since 2022 and responsible for roughly 900 known victim entities as of May 2025, also gains entry through exposed applications, including FortiOS, Microsoft Exchange ProxyNotShell, and activity associated with SimpleHelp `CVE-2024-57727`. Its tooling includes Grixba for domain-wide discovery and inventory of security, backup, and remote-management products, plus a custom VSS utility that copies locked files from shadow snapshots before encryption. Defenders should prioritize MFA and rapid remediation of internet-facing vulnerabilities, while monitoring for the WinRAR command-line pattern, WinSCP transfers, Defender exclusions, random service creation, PsExec activity, and executable writes under the Public Music directory; offline immutable backups and network segmentation remain essential to limit impact.
Sep 20, 2026