S0605 EKANS

malwareEnterpriseICS

platformsWindows

also known asEKANS · SNAKEHOSE

EKANS is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. EKANS has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in MegaCortex.

techniques used (13)

ATT&CK techniques this enables or maps to.

T0828Loss of Productivity and Revenue
T0840Network Connection Enumeration
T0849Masquerading
T0881Service Stop
T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1036.005Match Legitimate Resource Name or Location
T1047Windows Management Instrumentation
T1057Process Discovery
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan