In recent months, researchers have caught ransomware âintentionally tampering with industrial control systems that dams, electric grids, and gas refineries rely on to keep equipment running safely,â reports Ars Technica. According to researchers at the security firm Drago, the ransomware tries to kill 64 different processes, the names of which are all hard-coded within the malware.
https://dragos.com/wp-content/uploads/Figure-3.png
Long-time Slashdot reader Garabito shared Ars Technicaâs report:
It remains unclear precisely what effect the killing of those processes would have on the safety of operations inside infected facilitiesâĶ Mondayâs report described Ekansâ ICS targeting as minimal and crude because the malware simply kills various processes created by widely used ICS programs. Thatâs a key differentiator from ICS-targeting malware discovered over the past few years with the ability to do much more serious damage. One example is Industroyer, the sophisticated malware that caused a power outage in Ukraine in December 2016 in a deliberate and well-executed attempt to leave households without electricity in one of the countryâs coldest monthsâĶ
https://dragos.com/wp-content/uploads/Figure-2.png
Another reason Dragos considers Ekans to be a ârelatively primitive attackâ is that the ransomware has no mechanism to spread. That makes Ekans much less of a threat than ransomware such as Ryuk, which quietly collects credentials for months on infected systems so it can eventually proliferate widely through almost all parts of a targeted network.
!