{
  "family": "snow",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nSnow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate Windows systems, establish persistence, and execute destructive payloads. When operating as ransomware, Snow utilizes strong encryption algorithms to lock down the victim's critical data, demanding a ransom payment in exchange for the decryption key, causing immediate and severe operational downtime.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSnow is predominantly distributed via targeted phishing campaigns containing weaponized attachments, or by exploiting weak Remote Desktop Protocol (RDP) credentials exposed to the public internet.\n\nUpon successful execution, the malware operates with a focus on speed and destruction:\n<ul>\n<li><strong>Defense Evasion:</strong> Snow typically attempts to disable local Windows Defender services and terminate processes associated with enterprise backup solutions and database servers (e.g., SQL Server, Exchange) to ensure all data files are unlocked and ready for encryption.</li>\n<li><strong>Rapid File Encryption:</strong> The ransomware scans local drives and mapped network shares, targeting specific file extensions (documents, databases, archives). It encrypts these files using a strong cryptographic algorithm (often AES/RSA hybrid) and appends a specific extension (like `.snow`) to the encrypted files.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Snow almost universally executes commands (like `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After the encryption phase is complete, it drops a ransom note outlining the payment instructions (usually in cryptocurrency) and threatening permanent data loss.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Snow ransomware infection is a catastrophic security incident resulting in immediate, severe operational downtime and massive data loss. Due to the strength of modern encryption, files cannot be recovered without the private key or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Snow",
    "Trojan-Ransom.Win32.Snow",
    "Filecoder.Snow"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:16:56Z",
  "type": "Ransomware / Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}