Snatch is a financially motivated ransomware group operating a ransomware-as-a-service (RaaS) model since its emergence in 2018, initially known as Team Truniger. The group is notable for its unique defense evasion technique that involves rebooting compromised systems into Windows Safe Mode to bypass endpoint security software before encrypting data. Snatch employs a double extortion scheme, encrypting victim data and exfiltrating sensitive information, which they threaten to publish on their data leak site if ransom demands are not met. The group has adapted its tactics since mid-2021, leveraging successes from other ransomware variants and even purchasing previously stolen data to further pressure victims into paying. Snatch is assessed with high confidence to be of Russian origin, with command and control infrastructure often hosted on Russian bulletproof hosting services. The group sometimes lists victims alongside those of other ransomware gangs like Nokoyawa and Conti on its extortion blog, indicating a complex ecosystem of data monetization.^1,2

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

None Found