Threat Assessment: EKANS Ransomware
Summary: Unit 42 researchers observed EKANS ransomware activity affecting multiple industries in the U.S. and Europe, with the malware first seen in January 2020. Written in Golang, EKANS carries a static kill list that stops antivirus and Industrial Control Systems processes, deletes shadow copies, encrypts network-connected resources, and renames files with five random characters rather than a uniform extension.
What you should know: EKANS specifically targets ICS processes and has hit energy, healthcare, transportation, and manufacturing firms, so an asset owner whose recovery plan depends on shadow copies should note that EKANS deletes them before encrypting.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026