EKANS
- ID
- S0605
- Type
- Malware
- Associated names
- SNAKEHOSE
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
EKANS is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. EKANS has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in MegaCortex.[1][2]
Techniques used (9)
- T1016 System Network Configuration Discovery
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1057 Process Discovery
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1685 Disable or Modify Tools