EKANS - S0605 (00e7d565-9883-4ee5-b642-8fd17fd6a3f5)
EKANS is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. EKANS has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in MegaCortex.(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)