EKANS Ransomware Misconceptions and Misunderstandings

Dragos analyzes the EKANS (aka SNAKE) ransomware first reported in January 2020, describing its embedded process-kill functionality targeting ICS-related processes (data historians, licensing servers) to remove file locks prior to encryption. The report clarifies misattribution to the Turla/SNAKE state actor, assesses EKANS as likely criminal monetization rather than state-directed sabotage, and warns that although functionality is blunt and unsophisticated compared with ICS-focused sabotage malware, EKANS poses a serious operational risk to industrial environments and warrants increased visibility and incident response capability.