Snatch

Profile narrative

Snatch, also known as Snatch Team or Snatch Group, is a ransomware threat actor that has been active since at least 2018 and is described as Russian speaking. The group’s name references the Guy Ritchie film of the same name and it operates a leak site on the Tor network where it publishes victim data. Public reporting indicates the actors are based in Russia, although no direct state sponsorship has been demonstrated in the sources provided.

The actor targets a wide range of sectors including healthcare organizations such as hospitals and nursing associations, payment processors, IT service providers, defense contractors, educational institutions, automotive manufacturers, consultancies and nonprofit entities. Victims have been located in the United Kingdom, France, the United States, Canada, Italy and Germany, showing a transnational focus. Their strategic objective appears to be financial gain, achieved through double extortion tactics that combine data encryption with threats to leak stolen information unless a ransom is paid.

Snatch’s ransomware is notable for forcing infected systems to reboot into safe mode, a diagnostic state where resident antivirus software does not run, thereby allowing the malware to execute unhindered. After gaining access, the group exfiltrates sensitive data such as administrative credentials, network configurations and VPN schematics before encrypting files. They then publish proof of compromise on their leak site, often releasing a sample of the stolen files to validate their claims and increase pressure on the victim. This combination of safe mode execution, data theft, encryption and public shaming constitutes the core of their observed tooling and operational style.

Attribution assessments in open sources label Snatch as a Russian‑linked ransomware gang, though no explicit ties to a state apparatus or larger criminal consortium are cited. Representative operations include the June 2023 attacks on the Briars Group, EliTech Group and Mount Desert Island Hospital, the February 2023 intrusion into the payment processor Ingenico, the October 2022 compromise of HENSOLDT France, the September 2022 ransomware claim against a Wisconsin school district and the December 2021 breach of Volvo Cars’ research data. These incidents illustrate the group’s repeated use of safe mode tactics, double extortion and leak‑site publicity across varied industries and regions.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 10 sources.