Threat intelligence / Malware

EKANS

[EKANS](https://attack.mitre.org/software/S0605) is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. [EKANS](https://attack.mitre.org/software/S0605) has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in [MegaCortex](https://attack.mitre.org/software/S0576).(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[EKANS](https://attack.mitre.org/software/S0605) is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. [EKANS](https://attack.mitre.org/software/S0605) has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in [MegaCortex](https://attack.mitre.org/software/S0576).(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)

Labels

malware

9 recorded

Relationships

uses

to Data Encrypted for Impact

Technique

uses

to Disable or Modify Tools

Technique

uses

to Inhibit System Recovery

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Service Stop

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Windows Management Instrumentation

Technique

6 external

References

mitre-attack

S0605

EKANS

—

SNAKEHOSE

—

Dragos EKANS

https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/

Palo Alto Unit 42 EKANS

https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/

FireEye Ransomware Feb 2020

https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html