EKANS Ransomware and ICS Operations
Summary: EKANS ransomware emerged in mid-December 2019 and was first identified in a commercial virus repository on 26 December 2019; written in Go, it force-stops a hard-coded list of 64 processes, including GE Proficy historian, GE Fanuc licensing services, and Honeywell HMIWeb, before encrypting files and dropping a ransom note. Dragos later found the EKANS process list overlaps with the MegaCortex list, which contains over 1,000 referenced items, indicating continuity between the samples rather than a wholly new capability.
Why it matters: EKANS cannot inject commands into ICS processes, but running on the right system, such as a data historian, would induce a loss of view condition in the network - and its kill list was later shown to be a subset of MegaCortex's, tying it to a trend dating back to at least summer 2019.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026