PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus

blog.viettelcybersecurity.com | incident | #ransomware | #windows | #evasion | #data-theft | #snatch | #safe-mode
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A new Snatch ransomware variant reboots infected Windows hosts into Safe Mode to evade antivirus, persists as the SuperBackupMan service, wipes Volume Shadow Copies and also steals data.
Published
Collected

Related coverage

incident · blog.viettelcybersecurity.com
Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus
The Snatch ransomware reboots infected Windows machines into Safe Mode, where most third-party antivirus cannot run, then encrypts files and wipes shadow copies; it also exfiltrates data.
incident · blog.viettelcybersecurity.com
APT kết hợp với Ransomware: Phân tích thực trạng
A Viettel Cyber Security analysis of the current trend of APT groups combining their operations with ransomware attacks.
incident · blog.viettelcybersecurity.com
Nghiên cứu chuyên sâu về Tình hình mã độc mã hóa tống tiền tại Việt Nam
An in-depth Viettel Cyber Security study examining the ransomware threat landscape and attack trends across Vietnam.
incident · blog.viettelcybersecurity.com
Tấn công Ransomware “quật ngã” hệ thống ống dẫn nhiên liệu chủ chốt của Hoa Kỳ
A ransomware attack attributed to an Eastern European group forced Colonial Pipeline, supplier of nearly half the US East Coast's fuel, to shut down its entire system and triggered a federal response.
incident · blog.viettelcybersecurity.com
Ransomware Zeppelin nhắm vào các công ty công nghệ và chăm sóc sức khoẻ
Zeppelin, a new Delphi-based Vega ransomware variant, targets IT and healthcare firms in Europe, the US and Canada with customizable configs, AES-256 and RSA encryption, and stealth features.
incident · wiz.io
Defending against database ransomware attacks
Wiz examines 'malware-less' database ransomware: exposed MySQL, PostgreSQL and MongoDB servers with weak auth are looted, wiped and ransomed via native commands — no malware to detect.
Back