Skip to main content

Hit by ransomware? Isolate affected systems now. Do not reboot or reformat.

SheMo Noransom舍末无勒

Ransomware family

SnowSoul Ransomware Decryption & Data Recovery

  • Active
  • High
  • Some versions decryptable

SnowSoul is a China-focused ransomware family that surfaced in September 2025. It combines AES-CBC with RSA-2048 and has used .snowsoul, .qinglong and 5-random-character extensions. 360 built a decryptor covering some versions, and variants resumed spreading domestically from July 2026.

First seen
2025-09
File extensions
.snowsoul .qinglong .[5位随机字符（0-9 与 a-z）]
Ransom notes
No public information
Affected platforms
Windows / Databases

Public information on this family is limited. What follows is compiled from the small amount of verified material available, so please contact us for a sample assessment before you act on it.

Family profile

File extensions
  • .snowsoul
  • .qinglong
  • .[5位随机字符（0-9 与 a-z）]
Ransom notes
No public information
Contact patterns
  • Discord group handle (published by 360 as a Discord Group indicator)
  • A ransom note is dropped on the victim system; its filename and text are not published
  • No Tor leak site or negotiation portal observed
  • Same-named data-extortion activity pressures victims on hacker forums using ID-numbered posts
Aliases / versions
SnowSoul 勒索软件家族、qinglong 变种、snowsoul 变种
First seen
2025-09
Status
Active
Operational status
Back in action
Threat level
High
Affected platforms
  • Windows
  • Databases
Tags
  • Prevalent in China
  • Resurgent
  • Active
  • Exploits vulnerabilities
  • Targets databases
Decryptor
Some versions decryptable

SnowSoul is one of the few China-prevalent families with a free vendor decryption route. When 360 Digital Security published its sample analysis in November 2025 it reported that, although the family uses hybrid AES plus RSA-2048 encryption, its cryptographic implementation contains a critical design flaw, and that a decryptor built on that flaw had been validated against multiple samples.

The constraints matter. In its July and August 2026 monthly landscape reports 360 states that it supports decryption for some versions of this family, with manual identification by its anti-ransomware team required. Not every variant is covered. The tool is not listed on No More Ransom and is not a public download; it is obtained through 360's anti-ransomware service channel.

Keep three to five encrypted files and the original note for build identification, and only ever trial a decryptor against offline copies - never against the original disks.

Sources

Latest activity

  1. 360's August 2026 ransomware landscape report records that SnowSoul variants, which spread only within China, continue to circulate again, and repeats that 360 can decrypt some versions after manual identification.

    Sources

  2. 360's July 2026 monthly report attributes the .qinglong extension to SnowSoul and describes delivery as vulnerability exploitation plus database password brute-forcing, followed by hands-on deployment.

    Sources

  3. An actor branded SnowSoul claimed low-ransom data extortion against 25 organisations in China under ID-numbered cases, demanding about $2,000 and leaking roughly 30GB of corporate files on a hacker forum after refusal.

    Sources

Overview

SnowSoul surfaced abruptly in mainland China in September 2025. 360 Digital Security published a sample analysis that November and released what it called the first domestic decryptor for the family. Activity then went quiet, but 360's July and August 2026 monthly reports both record that variants of the SnowSoul family, which spreads only within China, have resumed circulating.

The family runs no leak site and no RaaS affiliate programme - 360 classes it as traditional rather than double-extortion ransomware - and hits servers and individual endpoints at Chinese enterprises and institutions. Malpedia and Maltiverse separately track a same-named extortion actor (since early 2026, roughly $2,000 demands, files leaked on hacker forums when refused); Malpedia associates no malware family with that actor, and public material does not establish whether the two are one crew.

Public information is limited. The ransom note filename and text and the full intrusion chain have never been published.

How to identify it

Extensions. 360's monthly keyword rankings list "snowsoul" in April 2026 and "qinglong" in July 2026, both explicitly attributed to this family; the original November 2025 sample instead appended five random characters (digits and lowercase letters), producing names of the form report.xlsx.xxxxx - the primary sample analysis publishes no worked example. The extension alone cannot identify the build.

Encrypted file structure (the most reliable marker). The first 8 bytes are the AES-CBC IV; the final 344 bytes are the AES key encrypted with RSA-2048 and Base64-encoded.

System artefacts. Task Manager disabled by registry policy, and a self-copied executable under %AppData%.

Ransom note. A note is dropped, but 360's report gives neither filename nor text; the published contact indicator is a Discord group handle.

Infection vectors

Public reporting gives only two entry paths, both pointing to the same pattern - take the server first, then deploy by hand:

  • Web application vulnerabilities. 360's April 2026 report records delivery via vulnerabilities in various software web components.
  • Database credential brute-forcing. The July 2026 report extends this to exploitation plus brute-forcing database passwords followed by hands-on deployment. The report says "database passwords" without naming a specific database product.

Hands-on deployment means the operator already held interactive access before encryption, so investigation must review web application logs and database authentication records. There is no public evidence of phishing, RDP brute-forcing or an ESXi/Linux encryptor.

Encryption behavior

Algorithms. File content is encrypted with AES-CBC and each AES key is wrapped with an RSA-2048 public key hardcoded into the sample, covering 532 common document and data file extensions.

Recovery inhibition - the part that matters most here:

  • After encryption the original is overwritten with "?" characters and then deleted, sharply reducing what low-level carving can recover.
  • bcdedit disables system recovery mode and all volume shadow copies are deleted.
  • Database files in the device's backup directory are force-deleted, resetting the system backup location.
  • Services holding target files open are stopped and Task Manager is disabled through the registry.

Public reporting describes no intermittent encryption, so intact regions inside large files must not be assumed.

Assess before you act

Recoverability assessment

SnowSoul has both a genuine vendor decryptor route and an overwrite-before-delete design hostile to low-level recovery. We do not pay ransoms and do not negotiate.

1) Vendor decryptor (some versions, highest priority). Requires manual identification by 360's anti-ransomware team, with the header and trailer intact. Identify the build from three to five encrypted files, validate on offline copies, then run at scale.

2) Files never encrypted (routinely underestimated). Only the 532 listed extensions are processed and some system directories are excluded; interrupted encryption leaves files untouched. A full-disk inventory comparison often recovers a first tranche of important data.

3) Backups, snapshots and shadow copies. Shadow copies and the local backup store are destroyed, but offline and offsite backups, NAS/SAN and hypervisor snapshots and cloud version history usually give the highest yield.

4) Unencrypted copies and log replay. Recycle bins, endpoint caches, reporting staging databases, ERP archive exports and database transaction logs can support reconstruction or point-in-time replay.

5) Low-level carving (constrained). Because originals are overwritten before deletion, carving yields far less than with comparable families; only files left untouched by interrupted encryption stand a real chance.

We never claim "100% decryption", and no technique guarantees full recovery.

Our response plan

Hit by SnowSoul ransomware? What to do

  1. Containment and forensic preservation

    Isolate affected servers from production networks and storage paths. Do not reboot, do not power off and do not write to the original disks - SnowSoul overwrites and deletes originals, so any extra write narrows what can be recovered. Image or snapshot the database and backup servers first, export internet-facing web application logs, database authentication records and remote access logs, and preserve three to five encrypted files, the original note and any suspicious executable under %AppData%.

  2. Family attribution and build identification

    Attribute from the fixed file layout: verify the leading 8-byte IV and the trailing 344-byte Base64 key block, then confirm SnowSoul using the extension (.snowsoul, .qinglong or five random characters) together with sample characteristics. The deliverable is whether the build falls inside the known decryptable range - that decision drives everything downstream, and the extension alone is not enough to make it.

  3. Recoverability assessment and plan sign-off

    Validate decryption feasibility against real samples in an isolated environment while inventorying files that were never encrypted, offline and offsite backups, storage-layer and hypervisor snapshots, cloud version history, and usable recovery points in database transaction logs. Deliver a written assessment: which data goes the decryption route, which relies on backup rollback, and which needs log replay or logical rebuild, with expected recovery ranges, timelines and a restoration order - then execute only after sign-off.

  4. Recovery execution and integrity verification

    All work happens on images or copies with the originals kept read-only. Restore in business priority order: core databases and production systems such as ERP and OA first, then file shares and office data. After each batch run integrity checks and business-side verification - reconciliation, report comparison, application start-up tests - and record everything in a traceable manifest. Spot-check decrypted files by type to confirm they open, so structurally damaged files are not handed back as recovered.

  5. Root-cause analysis, hardening and closeout

    Trace the root cause against this family's profile - web vulnerability, database password attack, hands-on deployment: audit internet-facing web applications and admin consoles for vulnerabilities and webshells, review MySQL/MSSQL internet exposure and password strength, and examine anomalous login sources. Hardening covers removing database services from the public internet, enforcing strong passwords and lockout on failed logins, patching web components, removing persistence files and registry policies, and rebuilding offline or immutable backups with a tested restore drill. Close with an incident report and formal sign-off.

Risk warning

What not to do

  • Do not pay, and do not contact the Discord handle in the note yourself. Some SnowSoul versions are decryptable - identify the build first, then decide anything else.
  • Do not format, reinstall or write to the original disks. This family overwrites originals with "?" before deleting them, so every extra write consumes what little low-level recovery space remains.
  • Do not run an unverified "SnowSoul decryptor" against original disks - validate on offline copies first. A failed attempt can damage the trailing key block and turn a recoverable file into an unrecoverable one.
  • Do not delete encrypted files, the ransom note or the suspicious executable under %AppData%. They are the only basis for identifying the build and judging whether decryption is possible.
  • Do not rush backup media or replacement servers back onto the original network. Until the web vulnerability and weak database credentials are closed, re-encryption is likely.
  • Do not clear system or security appliance logs. With shadow copies and the local backup store destroyed, web application and database authentication logs are often the only remaining forensic trail.

Emergency response

Data already encrypted? Stop and let an engineer look first

We do not pay ransoms and we do not negotiate with attackers. Engineers run a free assessment first, then propose a recovery plan and a firm quote.

+86 15639272850See contact details

Related scenarios

Related industries

Similar families

FAQ

SnowSoul Frequently asked questions

  • Can .qinglong files be decrypted?

    Possibly, but it is not a blanket yes. 360's July 2026 monthly report attributes the .qinglong extension to SnowSoul and states it supports decryption for some versions, subject to manual identification by its anti-ransomware team. Feasibility depends on the variant, not the extension. Keep three to five encrypted files and the note, get the build identified, and in parallel inventory backups and unencrypted copies rather than betting everything on a decryptor.

  • Is there a free SnowSoul decryptor, and where can I download it?

    360 Digital Security announced a dedicated SnowSoul decryption solution in November 2025, built on a design flaw in the family's cryptographic implementation. It is not listed on No More Ransom and there is no public download link - it is requested through 360's anti-ransomware service channel, with the build identified manually. Most pages advertising a "SnowSoul decryptor" are commercial recovery services or ads, and running an unverified binary against original disks risks damaging the files further.

  • The extension is five random characters - how do we confirm it is SnowSoul?

    Check the file structure, not just the extension. SnowSoul-encrypted files follow a fixed layout: the first 8 bytes are the AES-CBC IV and the last 344 bytes are the AES key encrypted with RSA-2048 and Base64-encoded. Verifying those two regions in a hex editor gives a high-confidence attribution. Supporting indicators include Task Manager disabled by registry policy, a self-copied executable under %AppData%, and deleted shadow copies and backup-directory databases.

  • Shadow copies and the local backup databases are gone - is recovery still possible?

    Yes, but look elsewhere. SnowSoul destroys the recovery points reachable from the compromised host; what the operator could not reach still stands a chance - offline and offsite backups, NAS/SAN storage-layer snapshots, hypervisor snapshots, unmounted copies on the backup server, cloud version history, and usable recovery points in database transaction logs. The family also only processes its list of 532 extensions, so a full-disk inventory comparison often recovers a first tranche of untouched data. Be aware that because originals are overwritten before deletion, conventional carving performs noticeably worse here than with comparable families.

  • Our company appears in a SnowSoul leak post - does that mean our files were encrypted too?

    Not necessarily - these are two claims that need separate verification. Public sources do not establish whether the hacker-forum extortion activity branded SnowSoul (roughly $2,000 demands under ID-numbered labels) is the same crew as the encryptor family tracked by 360. A forum listing may correspond to full encryption, exfiltration without encryption, or data assembled from a third party. Verify forensically first: compare filesystem timelines, egress traffic records and the authenticity of the posted content to establish the real encryption and exfiltration scope, then set your disclosure position, credential rotation scope and recovery priorities.

Sources

External links are provided for reference only. The content is published by third parties and does not represent our position.

Updated