Ransomware is malicious software that will lock up data on a computer’s drive, then travel across the network and encrypt other data. The saboteurs will then demand payment in exchange for releasing the data. Whereas industrial control system machines are high-value targets (healthcare is the other high-value target) EKANS is unusual in that the malicious code uses targeted intelligence for control systems to first encrypt the root data (files are encrypted and renamed with random 5-character extension) and then ruin the software processes and hold the data hostage.
EKANS targeted companies and are sent a ransom note with the instruction to pay the ransom in cryptocurrency. There is an email address provided for contact/replies.
Manufacturing plants, power grids, and industrial concerns (such as oil refineries) are all targets of this malicious malware.
Another feature of the EKANS ransomware is it is programed to terminate sixty-four (64) various processes on computers – most of which are ICS specific. This suggests the possibility that the EKANS may also share features similar to the Megacortex ransomware, which first appeared in early 2019. Megacortex relies on a manual method of deployment rather than self propagation ransomware deployment.
It is still unknown whether the EKANS ransomware originated from state-sponsored hackers or via real cybercriminals trying to profit from industrial control system owners. It appears that it may be the latter, based on the most recent analysis of the nature of the ransomware – analysis by Dragos researchers.
It is wise to raise awareness with among everyone who touches your systems and it would be prudent to have someone within your organization (or a consultant) tasked with keeping data security protections current. In addition, it is crucial to have ICS organizations rethink their cybersecurity leadership philosophy. In many organizations, the evangelists for cybersecurity are not equipped to exert influence in the company. Cybersecurity is still treated as a back-office job, but it needs to be treated as priority by the organizational leaders.
Dragos adversary hunters recommend keeping ICS systems segmented from the rest of the network. In this way, if just one Window machine is infected, the virus can’t mobilize to the systems that control the infrastructure. In addition, standard practices such as backups, stored offline, and including the last known good configuration data will somewhat reduce the liability of slow recovery. Guardrails such as improved access and mechanisms for authentication will also help to reduce the risk of these increasingly troubling attacks on ICS systems.
More detailed information can be accessed here:
https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/
Article courtesy of A-P Corporation, a manufacturer’s representative for the leading suppliers of sensors, instrumentation, and induction heating equipment. Providing professional sales engineering services to New England and upstate New York since 1959.