AEGIS Defender Now Blocking Snatch Ransomware IPs
The FBI and Cybersecurity and Infrastructure Security Agency (CISA) issued warnings this week on the Snatch ransomware gang, which has recently attacked South Africa's Defense Department and the city of Modesto California, USA. AEGIS has traced the IPs used by this criminal organization and has been blocking the IP addresses they use - since 2020.
Event logs from victims and CISA reports have shown traffic from both Russian Command and Control (C2) servers (Russian web hosting servers) and VPNs; all of which AEGIS has had in the Master Block List (MBL) for over 2 years. As new attacks are reported additional IPs are constantly researched and added to our MBL , 24/7/365.
According to the CISA, “Since mid-2021, Snatch threat actors have consistently evolved their tactics to take advantage of current trends in the cybercriminal space and leveraged successes of other ransomware variants’ operations. Snatch threat actors have targeted a wide range of critical infrastructure sectors including the Defense Industrial Base (DIB), Food and Agriculture, and Information Technology sectors.”
The hackers, formerly known as "Team Truniger," are using a Snatch variant used since 2019 that reboots computers in Safe Mode, disabling many AV software and endpoint protections. One of the only ways to defend against this threat is to block the IPs used to initiate contact in the first place and AEGIS Defender Pro is the only cybersecurity product that blocks IP’s used by criminal actors.
Here is a list of IPs reported by various sources used by Snatch actors:
- 188.22.29 (:443) *
- 188.22.29 (:37462) *
- 188.22.26 *
- 188.22.25 *
- 211.209.151 (:3306) *
- 59.146.180 *
- 147.228.91 *
- 61.149.242 *
- 140.125.150 *
- 91.229.77.161 * - Ukraine DeltaHost server - initial contact from this IP
- 193.70.12.240 * - France based OVH Sas
- 178.162.209.135 * - Germany based LeaseWeb server
* AEGIS Defender Pro is actively blocking these CIDRs
mydatasuperhero.com
mydatassuperhero.com
snatch24uldhpwrm.onion
snatch6brk4nfczg.onion
commands executed during the attack:
vssadmin delete shadows /all /quiet
bcdedit.exe /set {current} safeboot minimal
shutdown.exe /r /f /t 00
net stop SuperBackupMan
registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SuperBackupMan
Build IDs:
Go Build ID: `9sbGxHyc5vSAXzwvg6iZ/c_gG_xy9d6xmNt9nMlii/HdKHUjGFLxliYJycPc5E/yTT_FNpw78SfII62lGUn`
Go build ID: `2KZVw_piBNB6c74hlRt4/ueMyrcUcK4ismcjykWop/ZQYGFEYcaBSofxZbcs4g/GK-7e3PY8vHyy_lSkbVi`
Go build ID: `jPF3Jrx2uZ7VjN0GyDBL/x3B31XZylJgOhAVFZiym/o_aCHMB9kgaxIibXVOox/VQQhgCuLOuABGRrXzFdl`
Go build ID: `ULgusZVAlPcWOJcj9LKW/fOp_xyXqQQO5nzk3CZIW/LV-l8Ye8SLuN39dCmiDH/_34hEcu3a_yVC0sdeBdP`
Go build ID: `BIFnB6MdgF4djhq39TIM/0F-O_BMJNaIkMOFRC1kQ/j2Fm9d-Ilq-6KP4f1cuF/I07Xn6PJTdAcrP3IsVX4`
Go build ID: `cN2S005MM6pjpFXzNYd7/Lu1OzfnOLXKCy8mQdge9/GnIsH3q8hyF-pEAWP4K0/ISXM5yfoGT6hDQpcP08E`
Go build ID: `jPF3Jrx2uZ7VjN0GyDBL/x3B31XZylJgOhAVFZiym/o_aCHMB9kgaxIibXVOox/VQQhgCuLOuABGRrXzFdl`
Go build ID: `D4uZyyRaOm8WP2m599HU/gZkWHWmCm-S2lk0u6tJQ/F9Wz3xBbUlF3TISfF8Gu/uPBkEF2KfTla4ver6O79`
Go build ID: `nz4NhyAgWYITxG9Gw5rT/an0sbWQDT73tZEat72I5/KKmIcIIeFCNSYj4p5koW/BHky2GAanYgZQqXGSyei`
Ransom e-mails:
Ransom extensions:
.snatch
.jimm
.googl
.dglnl
.ohwqg
.wvtr0
.hceem
References
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a
https://thedfirreport.com/2020/06/21/snatch-ransomware/
https://github.com/sophoslabs/IoCs/blob/master/Ransomware-Snatch
