Skip to main content

Ransomware Uses New Method To Get Past Antivirus Programs

By December 20, 2019May 9th, 2022Cybersecurity

Researchers at SophosLabs have discovered a new threat to be on the alert for.  A variant of the Snatch ransomware has been spotted in the wild.

It features an innovative means of getting around whatever antivirus software you may be using to defend yourself.

Disguised as a backup utility, when the malware is installed, it forces the Windows PC it’s being installed on to reboot in Safe Mode.  This works because when the machine comes back up in Safe Mode, it’s running with a limited set of drivers and capabilities that don’t include antivirus software.  Since it’s not running, it obviously can’t detect the infection. It is ransomware, so as soon as the installation is complete, the files on the infected system are encrypted and unusable.

It gets worse.  In addition to locking the infected system down, Snatch will also attempt to delete all the Volume Shadow Copies in order to prevent forensic recovery of the encrypted files. On top of that, Snatch does more than simply encrypt files.  It also roots through the system and steals a wide range of data files, sending them off to a command and control server, even as it encrypts them.

The researchers report that Snatch can run on Windows versions 7 through 10, in both 32 and 64-bit versions. Of interest, it was written in Go, which is a programming language used by app developers to create cross-platform apps.  Although Snatch is currently only known to impact Windows-based machines, given the programming language used, the developers would have an easy time creating variants that could infect just about any system, running any OS.

The hackers controlling the code seem to have big plans. They’re advertising on underground forums on the Dark Web shopping for affiliates. They are hoping to partner with hackers or dissatisfied employees who have credentials that would enable the owners of the software to plant their malicious code inside large organizations.

Although there’s no evidence yet of a widespread campaign using Snatch, that day seems inevitable, so make sure your staff knows to stay on the alert for it.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.