Researchers have unveiled a new threat actor whose signature includes carrying out quick, rapid hacks which last roughly thirty (30) minutes. These attacks compromise their target, exfiltrate information such as company files/data, then extorts such data online until the target(s) pay a ransom to have it removed. The group, dubbed SnapMC, primarily breaches its victims via web-facing software vulnerabilities such as CVE-2019-18935; a vulnerability in the user interface for the Telerik ASPNET framework. SnapMC will only attack the victim for a limited amount of time, usually thirty (30) minutes. Once breached, the threat actors move rapidly to harvest data from accessible systems and make their covert exit. Post-breach, victims of SnapMC are contacted within hours with ransom demands and given roughly three (3) days to pay/negotiate with the threat group. To coerce companies to pay the ransom, SnapMC (like most ransomware actors) will leak a portion of the data to forums and markets as proof-of-compromise. While this threat group has no current affiliations, CTAPT has begun monitoring the movements of this threat group and will provide updates accordingly.