Ransomware Group intelligence
Snatch
InactiveTrack Snatch with 143 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Snatch is tracked by Breach House as a ransomware group with 143 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
143
- Leaked 0 0.0%
- Pending 143 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 5 | Web location | Down checked 4h ago | snatchnews.top |
| Leak location 4 | Web location | Down checked 4h ago | snatchteam.cc |
| Leak location 3 | Web location | Down checked 4h ago | snatchteam.top |
| Leak location 1 | Onion service | Down checked 4h ago | hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion |
| Leak location 2 | Web location | Down checked 4h ago | snatch.press |
Top Activity Sectors (17)
- Communication / Marketing 31
- Not identified 21
- Healthcare / Pharma 14
- Services 11
- Public Sector 10
- IT 9
- Finance / Legal / Insurance 7
- Education 7
- Manufacturing / Engineering 5
- Hospitality / Food & Beverage / Tourism 5
- Transportation / Travel / Logistics 4
- Energy 4
- Construction / Real Estate 3
- Telecommunications 3
- Retail / E-commerce 3
- Agriculture / Food 2
- NGOs / Associations 2
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Snatch, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: snatch uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: snatch modifies Windows Registry Run Keys to maintain persistence by launching ransomware components automatically on system startup.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: snatch disables antivirus tools and security software to evade detection and ensure ransomware execution proceeds unimpeded.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.010 Command Obfuscation Stealth
What they do: snatch obfuscates command strings and tool logic to evade static analysis and detection by security tools.
What that means: Adversaries may obfuscate content during command execution to impede detection.
-
T1070.004 File Deletion Stealth
What they do: snatch deletes Volume Shadow Copies and backup files via system commands to prevent data recovery and increase victim urgency.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: snatch accesses LSASS memory to steal credentials for lateral movement and privilege escalation to other hosts.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: snatch scans network shares to discover victim file structures and identify data for encryption or exfiltration.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: snatch exploits SMB/Windows Admin Shares to move laterally across networked systems within the victim environment.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: snatch exfiltrates stolen victim data via encrypted C2 channels before deployment to enable double-extortion tactics.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: snatch encrypts victim files and folders using strong symmetric cryptography to maximize impact and pressure for ransom payment.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Tools Observed (4)
▼Software Snatch has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
LOLBAS (living-off-the-land binaries)
BCDEdit
ServiceControl (sc.exe)
Offensive security tooling
Cobalt Strike
Meterpreter
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
snatch.txt
Hello! All your files are encrypted and only we can decrypt them. We have downloaded more that 500GB of sensitive data from your company servers. Contact us: [email protected] or [email protected] Write us if you want to return your files - we can do it very quickly! The header of letter must contain extension of encrypted files. We always reply within 24 hours. If not - check spam folder, resend your letter or try send letter from another email service (like protonmail.com). Attention! Do not rename or edit encrypted files: you may have permanent data loss. Do not edit or delete any virtual machines files To prove that we can recover your files, we am ready to decrypt any three files (less than 1Mb) for free (except databases, Excel and backups). HURRY UP! If you do not email us in the next 48 hours then your data may be lost permanently.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (143)
Search, filter and paginate the victim timeline for Snatch. Showing 101–143 of 143.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Yip in Tsoi id3031 View details | Thailand | Communication / Marketing | — | pending | |
|
Yip In Tsoi is an enterprise located in Thailand, with the main office in Bangkok , Special Governed District of. The enterprise operates in the Computer Systems Design Services industry. It was first established on 1930. Yip In Tsoi & Co Ltd currently employs 1,000 |
||||||
| Ransomware | Xtera id2800 View details | United States | IT | — | pending | |
|
Xtera deliver submarine cable solutions that maximise optical capacity and capability from seabed to city through outstanding expertise, know-how and technology innovation that is underpinned by leading-edge research and development. |
||||||
| Ransomware | Warren Resources id2799 View details | United States | Communication / Marketing | — | pending | |
|
Warren Resources’ properties include high-quality, low-decline conventional oil and natural gas assets in the core of the Wilmington Field, in L.A. County, CA. Our value-driven strategy focuses on continuously generating capital efficiencies and operation with low production and G&A costs, with a disciplined approach to |
||||||
| Ransomware | Private company #2 id2764 View details | Communication / Marketing | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | McDonald's id2726 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Back in 1954, a man named Ray Kroc discovered a small burger restaurant in California, and wrote the first page of our history. From humble beginnings as a small restaurant, we're proud to have become one of the world's leading food service brands with more |
||||||
| Ransomware | CIELD id2670 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | PFEIFER Drako id2669 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | PetroVietnam id2604 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Overseas Travel Agency id2537 View details | Transportation / Travel / Logistics | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Mab Group id2528 View details | United Arab Emirates | Services | — | pending | |
|
MAB Group with 13 subsidiaries and spread over 7 countries, we at MAB are evolving into one of the fastest growing industry specific services companies in the region. Headquartered in Dubai, the land of opportunities and an emerging super power in the world of business, |
||||||
| Ransomware | Thomson Broadbent id2513 View details | United States | Communication / Marketing | — | pending | |
|
Thomson Broadbent provides high quality advice to homeowners, developers, private estates and landowners whose properties are impacted by new road, rail, airport and existing or new electricity power line projects. Our role is to guide the landowner through the statutory processes and with our specialist |
||||||
| Ransomware | Vehicle Service Group id2461 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Hall Cross Academy id2460 View details | United Kingdom | Education | — | pending | |
|
Hall Cross is an historic institution which is proud of its traditions but what motivates us every day is securing the best future for every one of the young people we serve. A large and vibrant comprehensive academy with nearly 2000 students on roll including approximately |
||||||
| Ransomware | Private Company id2455 View details | United States | Communication / Marketing | — | pending | |
|
SSN_1.csv; PATIENTCONTACTS_VIEW.csv; IB_Appointment_Info.csv; location.csv; etl.csv; guarantor-2.csv; Policy_info-2.csv; contact-2.csv; contact.csv; EMED_REFILL_REQUEST.csv; ALLCAREGIVERS_VIEW.csv; IB_Provider_Info.csv; IB_Observation.csv; GHS_PatientRegistration.csv; DEMGUARANTOR-3.csv; IB_Emergency_Contact_Info.csv; etl_provider.csv; PATIENT_PORTAL_PATIENTS_VIEW.csv; etl_provider.csv; IMREPROV_CODE.csv; IB_Appointment_Info_ID.csv; IMREDEM_CODE.csv; ext_patient.csv; guarantor.csv; insurance.csv; Policy_info.csv; DEMOGRAPHICS.csv; Caregiver.csv; patient_info.csv; ARCH_DEMOGRAPHICS.csv; providers-3.csv; providers-2.csv; providers.csv; PORTAL_WEB_ACCOUNTSPORTAL_WEB_ACCOUNTS-2.csv; DEMGUARANTOR.csv; DEMGUARANTOR-2.csv; PORTAL_WEB_ACCOUNTSPORTAL_WEB_ACCOUNTS.csv; hpsite.patient.csv; Dbo.observation.info-2.csv; Dbo.observation.info.csv |
||||||
| Ransomware | Hanon Systems id2439 View details | Korea, Republic of | Communication / Marketing | — | pending | |
|
Hanon Systems manufactures a variety of automotive air control equipment. The Company's products include air conditioners, heaters, cooling modules, compressors, radiators, fans, evaporators, and condensers. Hanon Systems distributes its products on an original equipment manufacturing (OEM) basis. |
||||||
| Ransomware | HAPOLO id2438 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | TaxNetUSA id2429 View details | United States | Construction / Real Estate | — | pending | |
|
TaxNetUSA was founded in 1994 and has since become the leader in property tax information for the state of Texas and beyond. Created by property tax consultants, we serve the real estate and property tax industries with innovative tools and unlimited access to the most |
||||||
| Ransomware | Premium Transportation Group id2371 View details | United States | Communication / Marketing | — | pending | |
|
Since 1985 Premium Transportation Group, Inc. has consistently partnered with logistics companies to deliver customized, high-quality driver and logistics staffing, efficient human resource management, benefits administration and comprehensive workers’ compensation programs. Premium’s broad scope of services, combined with a large employee base and operations |
||||||
| Ransomware | TUI UK id2298 View details | United Kingdom | Retail / E-commerce | — | pending | |
|
When it comes to arranging your holiday, you can click on our website, pop into one of our stores, launch our app or call our contact centre. While you’re away, our 24/7 TUI Experience Centre means our global team of travel experts are on hand |
||||||
| Ransomware | LAVA id2297 View details | India | Telecommunications | — | pending | |
|
Lava International Limited is a leading Mobile Handset Company in India and has expanded its operations to multiple countries across the world. Right from its inception Lava has been at the forefront of building a strong ecosystem of design and manufacturing of mobile handsets. The |
||||||
| Ransomware | Leuze id2269 View details | Germany | IT | — | pending | |
|
With curiosity and determination, the Sensor People of Leuze have been driving innovation and technological milestones in industrial automation for more than 50 years. They are driven by the success of their customers. The technology leader’s high-tech product range includes a number of different sensors for |
||||||
| Ransomware | InTown Suites id2268 View details | United States | Communication / Marketing | pending | ||
|
With over 196 locations in 22 states, InTown Suites is America’s largest wholly owned economy extended stay brand. We’ve been providing outstanding value to guests for decades, and we know how to deliver an exceptional experience. We work hard to live up to our mission and |
||||||
| Ransomware | leuzeusa.com id2267 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Skyxe Saskatoon Airport id2250 View details | Canada | Transportation / Travel / Logistics | — | pending | |
|
Very incompetent in negotiations Chatlog will be added soon same as names of employees who told us "I don't care" |
||||||
| Ransomware | The Execu|Search Group id2178 View details | United States | Healthcare / Pharma | — | pending | |
|
With 250+ employees across the U.S., we offer direct hire recruiting, contract and staff augmentation, and workforce solutions for companies of all sizes. Our healthcare, technology, pharmaceutical, and professional services teams are each led by recruiters who are truly specialized in their respective fields. |
||||||
| Ransomware | ABC Seamless id2177 View details | United States | Communication / Marketing | — | pending | |
|
ABC Seamless has installed durable and beautiful steel home products since 1978 Our proven home improvement solutions and ironclad reputation make ABC one of the most trusted exterior renovation companies in the nation. |
||||||
| Ransomware | Medical Pharmacies id2160 View details | Canada | Healthcare / Pharma | — | pending | |
|
Medical Pharmacies is the leader in medication management, specialty pharmacy services and providing medical supplies and equipment to the Canadian healthcare industry. Working in a field that provides such critical services, their staff of over 1500 members has to be up-to-date on the latest drug recalls, |
||||||
| Ransomware | Altrux Medical id2110 View details | United States | Healthcare / Pharma | — | pending | |
|
Altrux Medical was established in 2006 and is headquartered in Atlanta, Georgia. We are a family owned and operated business. I enjoyed my early career in information technologies as an Apple Macintosh expert in the executive office suite industry, then home educated our three children. |
||||||
| Ransomware | Fittingbox id2109 View details | France | Retail / E-commerce | — | pending | |
|
Today, Fittingbox employs more than 80 people around the world, and counts more than 4,000 businesses among its clients, ranging from major international players of the optical and luxury industries such as lenses and frames manufacturers, optical franchises, e-retailers and luxury brands. |
||||||
| Ransomware | Lootah Group id2059 View details | United Arab Emirates | Communication / Marketing | — | pending | |
|
Formed at the heart of UAE in 1973 by the vision of Mr. Ibrahim Saeed Ahmed Lootah who hails from a Founding Family in Dubai, Lootah Group has consistently grown to become an international corporation with a strong world-wide presence. A 47-year old global conglomerate, |
||||||
| Ransomware | CareFirst CHPDC id2058 View details | United States | Healthcare / Pharma | — | pending | |
|
CareFirst BlueCross BlueShield Community Health Plan District of Columbia (CareFirst CHPDC) is a for-profit healthcare company which offers a comprehensive portfolio of health insurance benefits and services to over 66,000 enrollees in the District of Columbia. Since 2013, our team has provided comprehensive managed care |
||||||
| Ransomware | Volvo Car Corporation id2050 View details | Sweden | Manufacturing / Engineering | — | pending | |
|
The first Volvo car rolled off the Gothenburg production line in Sweden in 1927. Since then, Volvo Car Group has been a world-leader in safety technology and innovation. Today, Volvo is one of the most well-known and respected car brands in the world with sales |
||||||
| Ransomware | QRS Healthcare Solutions id2049 View details | United States | Healthcare / Pharma | — | pending | |
|
QRS INC. was founded in 1983 to help providers become profitable and to support them in their goals of better healthcare for their patients. We are proud of what we do, and we work hard to create a support environment built on personal relationships and |
||||||
| Ransomware | Amtech Corporation id2011 View details | United States | IT | — | pending | |
|
Recognized as one of the fastest growing, and most innovative, small businesses in the State of Washington, Amtech is a diverse manufacturer of composite-based products and parts. With expertise in Design, Engineering, and Research and Development, Amtech’s products are distributed in both military and commercial |
||||||
| Ransomware | APG Neuros id2010 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Salinen Austria id2009 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Ishida id2008 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Arbitech id2007 View details | United States | IT | — | pending | |
|
From our founding in 2000, Arbitech has become the world’s leading independent distributor of data center products, and a valuable complement to conventional distribution options. By providing quality products, quickly and efficiently, at low, hassle-free prices, Arbitech enables you to win more business. |
||||||
| Ransomware | Daylesford Organic id2006 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Bock, Hatch, Lewis & Oppenheim, LLC id2005 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Led by Phillip A. Bock, the attorneys at Bock Law Firm, LLC d/b/a Bock Hatch & Oppenheim, LLC have more than 100 years of litigation experience. We’ve spent most of that time litigating class actions on behalf of consumers, employees, and small businesses. We are competent, |
||||||
| Ransomware | Landmark Builders id2004 View details | United States | Communication / Marketing | — | pending | |
|
When Paul Stephens founded Landmark Builders in 1975, he was determined to make his company “the preferred builder that consistently delivers what is promised.” His principles of integrity, dependability, and a disciplined work ethic paved the way for Landmark to become one of the most |
||||||
| Ransomware | Match MG id2003 View details | Canada | Communication / Marketing | — | pending | |
|
Public Label’s cultural movements’ strategic and creative methodology redefines the future of marketing and advertising. At the same time, Match Retail’s grassroots, people-centric approach to retail engagement raises the bar to a whole new level. We invite you to explore these two new exciting agencies. |
||||||
| Ransomware | Cadence Aerospace id2002 View details | United States | Communication / Marketing | — | pending | |
|
Our Centers of Excellence are based in the USA and Mexico. We machine hard metals and aluminum alloys, perform sheet metal fabrication, titanium hot forming, produce assemblies, chemical processing and provide supply chain management in support of our products. With clearly defined products and services, |
||||||