SnapMC group uses scanners and special malware to steal company files

Information security specialists from Fox-IT discovered the SnapMC hack group, which steals company files and is engaged in extortion without encryption.

Attackers break into companies, steal data, and then demand a ransom from victims, threatening to publish the stolen data in the public domain or report a breach and media leak. Interestingly, such attacks take only about 30 minutes for hackers.

The group got its name from fast attacks and the use of the mc.exe tool to steal data. Experts write that usually hackers break into company networks using various vulnerabilities.

For these purposes, SnapMC uses the Acunetix vulnerability scanner and finds bugs in VPNs, web servers, and so on. For example, several intrusions were linked to the exploitation of the CVE-2019-18935 bug, a vulnerability in the Telerik ASP.NET UI component.

Having penetrated the victim’s network, hackers quickly move to collecting data and usually do not spend more than 30 minutes on the compromised network. To steal files, attackers use scripts to export data from a SQL database, then the CSV files are compressed using 7zip, and the MinIO client is used to transfer information to the hackers.

SnapMC then sends the hacked company an email listing the stolen files as evidence of the attack, and gives victims 24 hours to respond to the email and another 72 hours to agree on a ransom payment.

Fox-IT analysts emphasize that during the monitoring of the group, they did not notice that the hackers were using ransomware, although they had access to the victim’s internal network. Instead, attackers focus exclusively on data theft and subsequent extortion.

Let me remind you that we also reported that Grief ransomware threatens to destroy victims’ data if they turn to negotiators.