# New Ransomware Targets Industrial Control Systems 🖥

**URL:** <https://onehack.st/t/new-ransomware-targets-industrial-control-systems/69066>\
**Category:** News & Articles\
**Tags:** hacking, business\
**Created:** [February 9, 2020, 9:49am UTC](https://onehack.st/t/new-ransomware-targets-industrial-control-systems/69066 "2020-02-09T09:49:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [February 9, 2020, 9:49am UTC](https://onehack.st/t/new-ransomware-targets-industrial-control-systems/69066/1 "2020-02-09T09:49:27Z")

</div>

In recent months, researchers have caught ransomware “intentionally tampering with industrial control systems that dams, electric grids, and gas refineries rely on to keep equipment running safely,” reports Ars Technica. According to researchers at the security firm Drago, the ransomware [tries to kill 64 different processes](https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/), the names of which are all hard-coded within the malware.

[https://dragos.com/wp-content/uploads/Figure-3.png](https://dragos.com/wp-content/uploads/Figure-3.png)

Long-time Slashdot reader [Garabito](https://yro.slashdot.org/~Garabito) shared _Ars Technica’s_ report:

> It remains unclear precisely what effect the killing of those processes would have on the safety of operations inside infected facilities… Monday’s report described Ekans’ ICS targeting as minimal and crude because the malware simply [kills various processes created by widely used ICS programs](https://arstechnica.com/information-technology/2020/02/new-ransomware-intentionally-meddles-with-critical-infrastructure/). That’s a key differentiator from ICS-targeting malware discovered over the past few years with the ability to do much more serious damage. One example is Industroyer, the sophisticated malware that [caused a power outage in Ukraine](https://arstechnica.com/information-technology/2017/01/the-new-normal-yet-another-hacker-caused-power-outage-hits-ukraine/) in December 2016 in a [deliberate and well-executed attempt](https://hardware.slashdot.org/story/16/01/11/150241/ukraine-power-station-outage----enabled-by-malware-but-not-caused-by-malware) to leave households without electricity in one of the country’s coldest months…

[https://dragos.com/wp-content/uploads/Figure-2.png](https://dragos.com/wp-content/uploads/Figure-2.png)

> _Another reason Dragos considers Ekans to be a “relatively primitive attack” is that the ransomware has no mechanism to spread. That makes Ekans much less of a threat than ransomware such as Ryuk, which [quietly collects credentials for months on infected systems](https://arstechnica.com/information-technology/2019/01/new-ransomware-rakes-in-4-million-by-adopting-a-big-game-hunting-strategy/) so it can eventually proliferate widely through almost all parts of a targeted network._