Куда я попал?
EKANS
EKANS is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. EKANS has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in MegaCortex.(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)
ID: S0605
Associated Software: SNAKEHOSE
Type: MALWARE
Platforms: Windows
Version: 2.0
Created: 12 Feb 2021
Last Modified: 11 May 2022
Associated Software Descriptions |
|
| Name | Description |
|---|---|
| SNAKEHOSE | (Citation: FireEye Ransomware Feb 2020) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
EKANS stops processes related to security and management software.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
EKANS has been disguised as |
References
- Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
- Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.
- Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
- Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.