MITRE ATT&CKsoftware (malware)
S0605 EKANS
- Domain
- enterprise, ics
- Platforms
- Windows
- Aliases
- SNAKEHOSE
- Version
- 2.0
- Created
- 2021-02-12
Description
EKANS is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. EKANS has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in MegaCortex.
Related
Uses · MITRE ATT&CK (13)
- T1685 Disable or Modify Tools technique
- T0828 Loss of Productivity and Revenue technique
- T0840 Network Connection Enumeration technique
- T0849 Masquerading technique
- T0881 Service Stop technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
References
- https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/ Dragos EKANS
- https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/ Palo Alto Unit 42 EKANS
- https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html FireEye Ransomware Feb 2020