SnapMC group uses scanners and special malware to steal company files

Information security specialists from Fox-IT discovered the SnapMC hack group, which steals company files and is engaged in extortion without encryption.

Attackers break into companies, steal data, and then demand a ransom from victims, threatening to publish the stolen data in the public domain or report a breach and media leak. Interestingly, such attacks take only about 30 minutes for hackers.

The group got its name from fast attacks and the use of the mc.exe tool to steal data. Experts write that usually hackers break into company networks using various vulnerabilities.

For these purposes, SnapMC uses the Acunetix vulnerability scanner and finds bugs in VPNs, web servers, и така нататък. Например, several intrusions were linked to the exploitation of the CVE-2019-18935 bug, a vulnerability in the Telerik ASP.NET UI component.

Having penetrated the victim’s network, hackers quickly move to collecting data and usually do not spend more than 30 minutes on the compromised network. To steal files, attackers use scripts to export data from a SQL database, then the CSV files are compressed using 7zip, and the MinIO client is used to transfer information to the hackers.

SnapMC then sends the hacked company an email listing the stolen files as evidence of the attack, and gives victims 24 hours to respond to the email and another 72 hours to agree on a ransom payment.

Fox-IT analysts emphasize that during the monitoring of the group, they did not notice that the hackers were using ransomware, although they had access to the victim’s internal network. Instead, attackers focus exclusively on data theft and subsequent extortion.

NCC Group’s Threat Intelligence team predicts that data breach extortion attacks will increase over time, as it takes less time, and even less technical in-depth knowledge or skill in comparison to a full-blown ransomware attack. In a ransomware attack, the adversary needs to achieve persistence and become domain administrator before stealing data and deploying ransomware. While in the data breach extortion attacks, most of the activity could even be automated and takes less time while still having a significant impact.researchers report.

Let me remind you that we also reported that Grief ransomware threatens to destroy victims’ data if they turn to negotiators.

Хелга Смит

Винаги съм се интересувал от компютърни науки, особено сигурността на данните и темата, което се нарича в наши дни "наука за данни", от ранните ми тийнейджърски години. Преди да дойде в екипа за премахване на вируси като главен редактор, Работил съм като експерт по киберсигурност в няколко компании, включително един от изпълнителите на Amazon. Друг опит: Преподавам в университетите Арден и Рединг.

Оставете коментар

Този сайт използва Akismet за намаляване на спама. Научете как се обработват вашите коментарни данни.

Бутон за връщане в началото