Snake Ransomware Targeted Industrial Networks With Domain-Aware Encryption

Snake (also known as EKANS) was used in targeted intrusions against industrial organizations, including reported victims such as Honda and Enel Group, with malware samples customized for specific environments. Analysis showed the ransomware embedded an internal domain name and expected IP address, then encrypted files only if DNS resolution matched the hard-coded value, indicating deliberate victim validation and an effort to prevent execution outside the intended network. Researchers assessed the ransomware was typically deployed as the final stage of a multistage compromise after attackers obtained privileged access, likely including compromised domain administrator credentials used to spread the payload through domain policies.

Technical analysis of a Golang-based, Gobfuscate-obfuscated sample found Snake checked the victim environment through WMI and avoided encrypting primary or backup domain controllers, instead dropping a ransom note, while using those systems to preserve propagation capability. On non-controller hosts, the malware enabled and reconfigured Windows Firewall, killed numerous security and industrial-related processes and services, deleted shadow copies, and encrypted files using per-file AES-CTR keys protected with RSA-2048 OAEP; encrypted files were marked with the string EKANS. The malware also retained behavior relevant to operational technology environments, including attempts to terminate General Electric ICS-related processes, reinforcing concerns about its impact on industrial operations.