EKANS Ransomware Operators

Actor Type Criminal Group

The EKANS ransomware, also known as "Snake" (but not to be confused with the snake malware used by turla), emerged in 2019. The name EKANS comes from a string which is observed in the malware.

The ransomware encrypts files and displays a ransom note like typical ransomware, but EKANS stands out due to its additional functionality targeting operational technology (OT). Specifically, it forcibly stops a number of processes, including those related to Industrial Control Systems (ICS) operations. EKANS represents the first known ransomware variant which shows specific ICS targeting .

Reported victims of EKANS include Fresenius Group, Honda and Enel Group.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

EKANS Ransomware Operators Threat Reports

Report

Threat Assessment: EKANS Ransomware

This threat assessment from researchers at Palo Alto's Unit 42 covers the EKANS ransomware. According to the report, EKANS was first observed in ...

View Source
Report

EKANS Ransomware and ICS Operations

This blog post by researchers at Dragos talks about the EKANS ransomware variant. EKANS targets industrial control system (ICS) operations, and ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

ATT&CK ID Title Associated Tactics
T1080 Taint Shared Content Lateral Movement
T1119 Automated Collection Collection
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
T1204 User Execution Execution
T1486 Data Encrypted for Impact Impact
T1057 Process Discovery Discovery
T1083 File and Directory Discovery Discovery
T1005 Data from Local System Collection