snatch
First seen November 29, 2021Active142 claimed victims
The claims below are reproduced as posted by snatch on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so that it the malware can act without expected countermeasures and it can encrypt as many files as it finds. It uses common packers such as UPX to hide its payload.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Warren Resources | March 8, 2022 | ransomware_live | — |
| Xtera | March 8, 2022 | ransomware_live | — |
| Private company #2 | March 3, 2022 | ransomware_live | — |
| McDonald's | February 25, 2022 | ransomware_live | — |
| PFEIFER Drako | February 19, 2022 | ransomware_live | — |
| CIELD | February 19, 2022 | ransomware_live | — |
| PetroVietnam | February 9, 2022 | ransomware_live | — |
| Overseas Travel Agency | February 2, 2022 | ransomware_live | — |
| Mab Group | January 27, 2022 | ransomware_live | — |
| Thomson Broadbent | January 25, 2022 | ransomware_live | — |
| Hall Cross Academy | January 18, 2022 | ransomware_live | — |
| Vehicle Service Group | January 18, 2022 | ransomware_live | — |
| Private Company | January 16, 2022 | ransomware_live | — |
| HAPOLO | January 13, 2022 | ransomware_live | — |
| Hanon Systems | January 13, 2022 | ransomware_live | — |
| TaxNetUSA | January 11, 2022 | ransomware_live | — |
| Premium Transportation Group | January 5, 2022 | ransomware_live | — |
| LAVA | December 26, 2021 | ransomware_live | — |
| TUI UK | December 26, 2021 | ransomware_live | — |
| leuzeusa.com | December 21, 2021 | ransomware_live | — |
| InTown Suites | December 21, 2021 | ransomware_live | — |
| Leuze | December 21, 2021 | ransomware_live | — |
| Skyxe Saskatoon Airport | December 20, 2021 | ransomware_live | — |
| ABC Seamless | December 14, 2021 | ransomware_live | — |
| The Execu|Search Group | December 14, 2021 | ransomware_live | — |
| Medical Pharmacies | December 10, 2021 | ransomware_live | — |
| Fittingbox | December 7, 2021 | ransomware_live | — |
| Altrux Medical | December 7, 2021 | ransomware_live | — |
| CareFirst CHPDC | December 2, 2021 | ransomware_live | — |
| Lootah Group | December 2, 2021 | ransomware_live | — |
| QRS Healthcare Solutions | November 30, 2021 | ransomware_live | — |
| Volvo Car Corporation | November 30, 2021 | ransomware_live | — |
| Cadence Aerospace | November 29, 2021 | ransomware_live | — |
| Match MG | November 29, 2021 | ransomware_live | — |
| Landmark Builders | November 29, 2021 | ransomware_live | — |
| Bock, Hatch, Lewis & Oppenheim, LLC | November 29, 2021 | ransomware_live | — |
| Daylesford Organic | November 29, 2021 | ransomware_live | — |
| Arbitech | November 29, 2021 | ransomware_live | — |
| Ishida | November 29, 2021 | ransomware_live | — |
| Salinen Austria | November 29, 2021 | ransomware_live | — |
| APG Neuros | November 29, 2021 | ransomware_live | — |
| Amtech Corporation | November 29, 2021 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).