A Closer Look at the Snatch Data Ransom Group
Summary: A September 20, 2023 FBI and CISA joint advisory says Snatch, originally named Team Truniger after its founder, used a ransomware variant that rebooted Windows devices into Safe Mode to evade antivirus before encrypting files. The advisory says Snatch actors spent up to three months on victim systems, moved laterally with RDP, exfiltrated data, and bought previously stolen data from other ransomware variants to pressure victims into paying. Flashpoint traced the group to 2018, when Truniger recruited 'pen testers' and Windows system administrators on Russian-language cybercrime forums and programming boards.
Why it matters: Three months of dwell time before encryption means the intrusion is over long before the ransom note appears, and a group that reboots machines into Safe Mode to blind endpoint protection is betting your detection stops at the operating system's own recovery mode.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026