Industrial Control Systems Cyber Emergency Response TeamAA23-263A#StopRansomware: Snatch Ransomware
Actions to take today to mitigate malicious cyber activity:
- Secure and closely monitor Remote Desktop Protocol (RDP).
- Maintain offline backups of data.
- Enable and enforce phishing-resistant multifactor authentication (MFA).
References
attack.mitre.org/versions/v13/matrices/enterprise/
attack.mitre.org/versions/v13/software/S0154/
attack.mitre.org/versions/v13/tactics/TA0010/
attack.mitre.org/versions/v13/tactics/TA0010/
attack.mitre.org/versions/v13/techniques/T1005/
attack.mitre.org/versions/v13/techniques/T1005/
attack.mitre.org/versions/v13/techniques/T1012/
attack.mitre.org/versions/v13/techniques/T1012/
attack.mitre.org/versions/v13/techniques/T1021/001/
attack.mitre.org/versions/v13/techniques/T1021/001/
attack.mitre.org/versions/v13/techniques/T1036/
attack.mitre.org/versions/v13/techniques/T1036/
attack.mitre.org/versions/v13/techniques/T1057/
attack.mitre.org/versions/v13/techniques/T1057/
attack.mitre.org/versions/v13/techniques/T1059/003/
attack.mitre.org/versions/v13/techniques/T1059/003/
attack.mitre.org/versions/v13/techniques/T1070/004/
attack.mitre.org/versions/v13/techniques/T1070/004/
attack.mitre.org/versions/v13/techniques/T1071/001/
attack.mitre.org/versions/v13/techniques/T1071/001/
attack.mitre.org/versions/v13/techniques/T1078/
attack.mitre.org/versions/v13/techniques/T1078/
attack.mitre.org/versions/v13/techniques/T1078/002/
attack.mitre.org/versions/v13/techniques/T1078/002/
attack.mitre.org/versions/v13/techniques/T1110/001/
attack.mitre.org/versions/v13/techniques/T1110/001/
attack.mitre.org/versions/v13/techniques/T1112/
attack.mitre.org/versions/v13/techniques/T1112/
attack.mitre.org/versions/v13/techniques/T1133/
attack.mitre.org/versions/v13/techniques/T1133/
attack.mitre.org/versions/v13/techniques/T1133/
attack.mitre.org/versions/v13/techniques/T1486/
attack.mitre.org/versions/v13/techniques/T1486/
attack.mitre.org/versions/v13/techniques/T1490/
attack.mitre.org/versions/v13/techniques/T1490/
attack.mitre.org/versions/v13/techniques/T1562/001/
attack.mitre.org/versions/v13/techniques/T1562/001/
attack.mitre.org/versions/v13/techniques/T1562/009/
attack.mitre.org/versions/v13/techniques/T1562/009/
attack.mitre.org/versions/v13/techniques/T1569/002/
attack.mitre.org/versions/v13/techniques/T1569/002/
attack.mitre.org/versions/v13/techniques/T1583/003/
attack.mitre.org/versions/v13/techniques/T1583/003/
attack.mitre.org/versions/v13/techniques/T1590/
attack.mitre.org/versions/v13/techniques/T1590/
github.com/cisagov/cset/releases/tag/v10.3.0.0
github.com/cisagov/Decider/
pages.nist.gov/800-63-3/
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=%23StopRansomware%3A%20Snatch%20Ransomware+https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a
www.cisa.gov/cpg
www.cisa.gov/cyber-hygiene-services
www.cisa.gov/known-exploited-vulnerabilities-catalog
www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping
www.cisa.gov/resources-tools/resources/secure-by-design-and-default
www.cisa.gov/resources-tools/resources/stopransomware-guide
www.cisa.gov/securebydesign
www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf
www.databreaches.net/at-some-point-snatch-team-stopped-being-the-snatch-ransomware-gang-were-journalists-the-last-to-know/
www.databreaches.net/at-some-point-snatch-team-stopped-being-the-snatch-ransomware-gang-were-journalists-the-last-to-know/
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a&title=%23StopRansomware%3A%20Snatch%20Ransomware
www.fbi.gov/contact-us/field-offices/
www.ic3.gov/
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a
www.oig.dhs.gov/
www.stopransomware.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=%23StopRansomware%3A%20Snatch%20Ransomware&body=www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a