EKANS
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 3 sources
- First seen
- 2020-06-07
- Last seen
- 2020-06-07
- Updated
- 2026-10-11 01:25
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
EKANS, also known as SNAKE, is a ransomware threat actor believed to operate from Russia. The actor primarily targets energy, automotive, and healthcare sectors, focusing on organizations with industrial control systems, and seeks financial gain through bitcoin ransom payments while also stealing data before encryption. Its tactics include checking for internal domain names and IP addresses to confirm a target environment, exploiting exposed remote desktop connections for initial access, and terminating SCADA and ICS processes to disrupt operations. Notable incidents involve the Enel Group, Honda, and Fresenius in 2020, where the ransomware was detected before widespread encryption but caused temporary network isolations.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 3 sources.