Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 03:12:57 UTC
Home > List all groups > List all tools > List all groups using tool EKANS
 Tool: EKANS
Names
EKANS
Snake
SNAKEHOSE
Category Malware
Type ICS malware, Ransomware, Big Game Hunting
Description
(Dragos) EKANS ransomware emerged in mid-December 2019, and Dragos published a
private report to Dragos WorldView Threat Intelligence customers early January 2020.
While relatively straightforward as a ransomware sample in terms of encrypting files
and displaying a ransom note, EKANS featured additional functionality to forcibly stop
a number of processes, including multiple items related to ICS operations. While all
indications at present show a relatively primitive attack mechanism on control system
networks, the specificity of processes listed in a static “kill list” shows a level of
intentionality previously absent from ransomware targeting the industrial space. ICS
asset owners and operators are therefore strongly encouraged to review their attack
surface and determine mechanisms to deliver and distribute disruptive malware, such as
ransomware, with ICS-specific characteristics.
Information
MITRE ATT&CK Malpedia AlienVault OTX Playbook https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8236a50f-f937-4e6e-b935-8dea58971dfa
Page 1 of 2

Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool EKANS
Changed Name Country Observed
Unknown groups
  _[ Interesting malware not linked to an actor yet ]_  
1 group listed (0 APT, 0 other, 1 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8236a50f-f937-4e6e-b935-8dea58971dfa
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8236a50f-f937-4e6e-b935-8dea58971dfa
Page 2 of 2