Team Truniger

Team Truniger, also known as Snatch, is a threat actor group that first emerged in 2018. The group was initially named after the online handle of its founder and organizer, Truniger, who had previously worked as an affiliate of the GandCrab ransomware-as-a-service operation. According to a joint advisory from the FBI and the U.S. Cybersecurity and Infrastructure Security Administration (CISA) issued on September 20, 2023, this group has Russian origins and uses command-and-control servers hosted in Russia to launch its attacks. The modus operandi of Team Truniger involves a sophisticated technique of rebooting Windows PCs into safe mode to bypass existing anti-virus protection. This method is part of their ransomware attack strategy, which also includes purchasing data stolen by other hacking groups to further extort victims. Their evolution from a GandCrab affiliate to a full-fledged threat actor showcases their increasing technical prowess and malicious intent. Since mid-2021, Team Truniger has been targeting a wide range of critical infrastructure sectors, posing a significant threat to cybersecurity. The FBI and CISA have issued multiple advisories warning about the activities of this group, formerly known as Snatch. These advisories highlight the urgent need for robust cybersecurity measures and constant vigilance to counter the threats posed by such advanced persistent threat (APT) groups.