EKANS Ransomware Misconceptions and Misunderstandings
Summary: Dragos reports that EKANS ransomware, first publicly disclosed on 06 January 2020 by Vitali Kremez and MalwareHuntTeam, has been traced to at least attempted intrusions against high-profile organizations since 2020. Dragos assesses with high confidence that EKANS's process kill functionality - aimed at ICS data historians, licensing servers and similar items - is designed to remove file locks so vital files can be encrypted, not to manipulate industrial processes.
Bottom line: Dragos states EKANS has no known, provable connection to the SNAKE/Turla actor, and that linking it to state sponsorship rests on logical leaps it could not prove - yet the same blunt, indiscriminate process termination can cause unintended side effects in production environments, which Dragos says could lead to potentially disastrous process interruption.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026