SNAKE ransomware looks to encrypt an entire business network
A new ransomware family has been discovered that is being used to target and encrypt all of the devices on business networks.
The SNAKE ransomware is the latest example of enterprise targeting ransomware which is used by cybercriminals to infiltrate business networks, gather administrative credentials and encrypt the files of every computer on a network using post-exploitation tools.
Other notable enterprise targeting ransomware families include Ryuk, BitPaymer, DoppelPaymer, Sodinokibi, Maze, MegaCortex and Locker Goga.
- Donald Trump ransomware spreads dangerous malware
- Ransomware mutations double in 2019
- Also check out the best free anti-ransomware software tools
SNAKE ransomware
The SNAKE ransomware was first discovered by the MalwareHunterTeam which then shared it with the ethical hacker Vitali Kremez in order to reverse engineer it. Kremez’s analysis of the ransomware revealed that it is written in Golang and contains a higher level of obfuscation than is typical with these kinds of infections.
Once the SNAKE ransomware enters a business’ network, it removes the Shadow Volume Copies stored on computers and then kills a number of processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software and more. The ransomware then encrypts the files on each device while skipping any files located in Windows system folders and other system files.
The SNAKE ransomware adds a random five character string to the file extension of each file it encrypts and it also changes the ‘EKANS’ file marker (EKANS is SNAKE in reverse) of every encrypted file.
Once a computer’s files have been encrypted, the program creates a ransom note on a user’s desktop named Fix-Your-Files.txt. The note itself contains an email address to contact the cybercriminals who will provide a decryption tool loaded with a private key created specifically for the user’s network for a fee.
The SNAKE ransomware poses a major threat to corporate networks because it encrypts files on all of the computers on the network as opposed to just those on a single machine.
- We’ve also highlighted the best antivirus software
Via BleepingComputer