Security News > 2020 > January > New Snake Ransomware Targets ICS Processes
According to SentinelLabs, which has seen attacks involving Snake for the past month, files encrypted by this ransomware are difficult or impossible to recover without paying the ransom demanded by the attackers.
Snake targets a wide range of files, but avoids encrypting system files and folders.
Before it starts encrypting files, it attempts to terminate processes associated with various types of programs, including system utilities, enterprise management tools and even ICS. SentinelLabs has mentioned Honeywell's HMIWeb display builder and Israel-based industrial cybersecurity firm OTORIO says a majority of the industrial processes targeted by Snake are associated with products made by GE. OTORIO says Snake terminates a critical process for the GE Digital Proficy server, which enables connectivity to the Proficy HMI/SCADA, Manufacturing Execution Systems, and Enterprise Manufacturing Intelligence systems.
"The potential damage of a Snake attack is significant," says Dor Yardeni, head of incident response and threat Hunting at OTORIO. "Deleting or locking targeted ICS processes would prohibit manufacturing teams from accessing vital production-related processes, including analytics, configuration and control. This is the equivalent of both blindfolding a driver and then taking away the steering wheel".
While SentinelOne says "There may very well be a relationship between the Snake and Dustman attacks," OTORIO believes that Snake may have actually been used in an attack on Bapco.