snatch
First seen November 29, 2021Active142 claimed victims
The claims below are reproduced as posted by snatch on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so that it the malware can act without expected countermeasures and it can encrypt as many files as it finds. It uses common packers such as UPX to hide its payload.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Neovia | May 15, 2024 | ransomware_live | — |
| UK government | May 1, 2024 | ransomware_live | — |
| The Royal Family of Great Britain | April 16, 2024 | ransomware_live | — |
| Miki Travel Limited | March 26, 2024 | ransomware_live | — |
| Retirement Line | March 19, 2024 | ransomware_live | — |
| Butler, Lavanceau & Sober | March 17, 2024 | ransomware_live | — |
| Dörr Group | March 12, 2024 | ransomware_live | — |
| Seven Seas Group | March 4, 2024 | ransomware_live | — |
| Frencken | February 28, 2024 | ransomware_live | — |
| HSPG & Associates | February 28, 2024 | ransomware_live | — |
| Hawbaker Engineering | February 13, 2024 | ransomware_live | — |
| US government (private data) +Rothschild&Rockefeller | January 25, 2024 | ransomware_live | — |
| US government (private data) | January 23, 2024 | ransomware_live | — |
| Banco Promerica | January 11, 2024 | ransomware_live | — |
| Malabar Gold & Diamonds | January 11, 2024 | ransomware_live | — |
| Charm Sciences | January 11, 2024 | ransomware_live | — |
| Spaulding Clinical | December 14, 2023 | ransomware_live | — |
| Kraft Foods | December 14, 2023 | ransomware_live | — |
| Jerry Pate Energy (hack from Saltmarsh Financial Advisors) | December 4, 2023 | ransomware_live | — |
| Canadian Psychological Association | November 27, 2023 | ransomware_live | — |
| Hunt Guillot & Associates | November 27, 2023 | ransomware_live | — |
| Tyson Foods | November 24, 2023 | ransomware_live | — |
| Kologik | November 24, 2023 | ransomware_live | — |
| ALVImedica | November 24, 2023 | ransomware_live | — |
| Montachusett Regional Vocational Technical School District | November 17, 2023 | ransomware_live | — |
| Maldives Ports Limited | November 17, 2023 | ransomware_live | — |
| Museum für Naturkunde | November 13, 2023 | ransomware_live | — |
| Detroit Symphony Orchestra | November 1, 2023 | ransomware_live | — |
| Ancillae-Assumpta Academy | October 25, 2023 | ransomware_live | — |
| M&n Management | October 25, 2023 | ransomware_live | — |
| Cogal Industry | October 16, 2023 | ransomware_live | — |
| Intech | October 14, 2023 | ransomware_live | — |
| Alliance Virgil Roberts Leadership Academy | October 10, 2023 | ransomware_live | — |
| Florida Department of Veterans' Affairs | September 19, 2023 | ransomware_live | — |
| ZILLI | September 19, 2023 | ransomware_live | — |
| CEFCO | September 19, 2023 | ransomware_live | — |
| Knight Barry Title | September 4, 2023 | ransomware_live | — |
| Fullerton India (SMFG India Credit) | August 27, 2023 | ransomware_live | — |
| Department of Defence South African | August 21, 2023 | ransomware_live | — |
| Department of Defence South African (DARPA) | August 21, 2023 | ransomware_live | — |
| Alinabal | July 29, 2023 | ransomware_live | — |
| Wasserstrom | July 18, 2023 | ransomware_live | — |
| Ningbo Joyson Electronic Corp. | July 18, 2023 | ransomware_live | — |
| Seasia Infotech | July 18, 2023 | ransomware_live | — |
| Tampa general hospital | July 18, 2023 | ransomware_live | — |
| Medical University of the Americas | June 21, 2023 | ransomware_live | — |
| Telcoset | June 20, 2023 | ransomware_live | — |
| TF AMD Microelectronics | June 14, 2023 | ransomware_live | — |
| MCNA Dental | June 14, 2023 | ransomware_live | — |
| Hemenway Financial Services | June 14, 2023 | ransomware_live | — |
| Bunker Hill Community College | June 14, 2023 | ransomware_live | — |
| James Briggs Limited | June 14, 2023 | ransomware_live | — |
| Tetrosyl Group | June 14, 2023 | ransomware_live | — |
| Fullerton India | June 13, 2023 | ransomware_live | — |
| Global Remote Services | June 12, 2023 | ransomware_live | — |
| Avant Grup | June 5, 2023 | ransomware_live | — |
| The Briars Group | June 5, 2023 | ransomware_live | — |
| Mount Desert Island Hospital | June 5, 2023 | ransomware_live | — |
| ELITechGroup | June 5, 2023 | ransomware_live | — |
| SsangYong Motor | June 3, 2023 | ransomware_live | — |
| Chattanooga State Community College | May 23, 2023 | ransomware_live | — |
| Asia Vital Components | May 22, 2023 | ransomware_live | — |
| LiveAction | May 22, 2023 | ransomware_live | — |
| MSSNY | May 22, 2023 | ransomware_live | — |
| FRESCA | May 22, 2023 | ransomware_live | — |
| Canadian Nurses Association | May 22, 2023 | ransomware_live | — |
| Comoli Ferrari | May 22, 2023 | ransomware_live | — |
| IXPERTA | May 15, 2023 | ransomware_live | — |
| Lawrence Family Development Charter School | May 3, 2023 | ransomware_live | — |
| Americana Restaurants | April 7, 2023 | ransomware_live | — |
| Gaston College | April 2, 2023 | ransomware_live | — |
| City of Modesto, CA | March 28, 2023 | ransomware_live | — |
| The Metropolitan Opera | March 2, 2023 | ransomware_live | — |
| MSX International | February 27, 2023 | ransomware_live | — |
| Ingenico | February 27, 2023 | ransomware_live | — |
| Physician Partners of America | January 12, 2023 | ransomware_live | — |
| Einatec | December 28, 2022 | ransomware_live | — |
| Trubee, Collins & Co | December 28, 2022 | ransomware_live | — |
| TCL Chinese Theatres | December 28, 2022 | ransomware_live | — |
| Square Yards | December 28, 2022 | ransomware_live | — |
| ET GLOBAL | December 28, 2022 | ransomware_live | — |
| Centro Turistico Giovanile | December 28, 2022 | ransomware_live | — |
| STGi | November 28, 2022 | ransomware_live | — |
| SAIPRESS | November 20, 2022 | ransomware_live | — |
| McGRATH | November 20, 2022 | ransomware_live | — |
| Saurer | November 13, 2022 | ransomware_live | — |
| YASH Technologies | November 13, 2022 | ransomware_live | — |
| Grandview, MO | November 1, 2022 | ransomware_live | — |
| HENSOLDT France | October 30, 2022 | ransomware_live | — |
| Kenosha Unified School District | October 24, 2022 | ransomware_live | — |
| Weidmuller | October 19, 2022 | ransomware_live | — |
| Oil India Limited | October 5, 2022 | ransomware_live | — |
| Unicity | October 5, 2022 | ransomware_live | — |
| Empower Insurance | October 5, 2022 | ransomware_live | — |
| OPPLE Lighting | October 5, 2022 | ransomware_live | — |
| Stratford University | August 17, 2022 | ransomware_live | — |
| Atlantic Dialysis Management Services | June 30, 2022 | ransomware_live | — |
| Apex | June 29, 2022 | ransomware_live | — |
| HEMERIA | May 22, 2022 | ransomware_live | — |
| Yip in Tsoi | March 31, 2022 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).