In recent weeks, the security industry has become acutely aware of the challenges surrounding OT protection, with the EKANS ransomware attacks on Honda and the Enel Group demonstrating how novel threats continue to slip through the cracks of security systems in ICS environments. What’s more, with such attacks resulting in loss of productivity and damage to critical infrastructure, the need for a cyber security strategy that bridges both OT and IT technology is increasingly urgent.

The recent EKANS ransomware has been making waves in security circles because of its ability to target 64 specific ICS mechanisms in its ‘kill chain’. Standard attacks target ICS environments through vulnerabilities in IT infrastructure, pivoting through unpatched software to reach OT machinery, rather than heading straight for the jugular. The EKANS ransomware targeted ICS vulnerabilities directly and can be considered the first of its kind – marking a significant evolution in attacker techniques. Before now, ICS machinery-specific ransomware had either been an academic theory or a marketing tool.

Technical analysis

Written in the Go programming language, EKANS has additional obfuscation abilities compared to other ransomware strains, which enable it to better evade detection. As will be seen in this analysis, the power of EKANS ransomware is two-fold – it is able to disguise its attack in the beginning stages, and when it does strike, it is targeted at industrial pain points.

The ransomware’s first port of call is to check if the victim has already been encrypted. If not, standard encryption library functions ensue. These involve both the execution of encryption operations and the deletion of Volume Shadow Copy back-ups – meaning the victim cannot simply retrieve duplicated data copies and circumvent the ransom.

Before the relevant files are encrypted, EKANS ransomware kills various ICS processes listed in a pre-programmed, hard-coded list. The affected applications include GE’s Proficy data historian, GE Fanuc automation software, FLEXNet licensing server instance, Thingworx monitoring and management software, and Honeywell’s HMIWeb application – all specific to ICS environments.

proficyclient.exe
vmacthlp.exe
msdtssrvr.exe
sqlservr.exe
msmdsrv.exe
reportingservicesservice.exe
dsmcsvc.exe
winvnc4.exe
client.exe
collwrap.exe
bluestripecollector.exe

Figure 1: A small excerpt of the ICS-related processes targeted in the EKANS ‘kill list’

While stalling these processes doesn’t necessarily bring industrial plants crashing to a halt, it does reduce visibility and potentially make machine operations unpredictable. In the case of Honda’s attack, manufacturing operations across the US, the UK, and Turkey were suspended. With a workforce of 220,000 people worldwide, shutting down several factories and sending employees home results in a dramatic loss of production hours and employee salaries – not to mention the costs of getting systems up and running without giving in to ransom demands.

EKANS then goes one stage further. Once this initial kill chain has been executed, the ransomware starts encrypting data. Five randomly generated letters are added at the end of each original file extension. This in itself is unusual, as most ransomware encrypts data with a specific key.

Figure 2: Encryption results of EKANS ransomware

Rather than targeting specific devices or systems, EKANS ransomware looks to take down the entire network, which is part of what makes it such an aggressive style of ransomware. However, it lacks a self-propagating mechanism, so it has to be manually introduced to ICS environments. Malicious payloads hidden in links and attachments within emails are the primary mechanism used to introduce the ransomware. From there, EKANS exploits vulnerable and unpatched services, seeding itself across the entire business via script.

When the encryption process has been completed, a ransom note is displayed, requesting a covert financial exchange for a decryption key over the encrypted email platform CTemplar. In the case of both Honda and the Enel Group, they were told to contact CarrolBidell@tutanota[.]com for further information. The attackers also offered to send several decrypted files to prove the legitimacy of the encryption key.

| What happened to your files?
--------------------------------------------
We breached your corporate network and encrypted the data on your computers. The encrypted data includes documents, databases, photos and more –
all were encrypted using a military grade encryption algorithms (AES-256 and RSA-2048). You cannot access those files right now. But dont worry!
You can still get those files back and be up and running again in no time.
--------------------------------------------
| How to contact us to get your files back?
--------------------------------------------
The only way to restore your files is by purchasing a decryption tool loaded with a private key we created specifically for your network.
Once run on an effected computer, the tool will decrypt all encrypted files – and you resume day-to-day operations, preferably with
better cyber security in mind. If you are interested in purchasing the decryption tool contact us at %s
--------------------------------------------
| How can you be certain we have the decryption tool?
--------------------------------------------
In your mail to us attach up to 3 files (up to 3MB, no databases or spreadsheets).

Figure 3: Partial view of EKANS ransomware note

Honda has refrained from stating what specific plant capabilities were affected by the EKANS attack, however it has publicly affirmed that production operations have been affected in multiple factories across the world. Their visibility and control systems were disrupted significantly enough to suspend manufacturing.

Becoming immune to ransomware

While the EKANS ransomware leverages fairly crude techniques and is only able to halt processes rather than control ICS mechanisms, it represents a new frontier in OT cyber-attacks. ICS offensives will continue to evolve – with greater control over machinery a likely avenue of exploration for cyber-criminals.

What is clear from the Honda attack is that even some of the world’s largest global conglomerates are susceptible to these kind of ransomware attacks. What is needed to protect factory floors from such attacks is a cyber security solution that can detect the most subtle signals of threat, learning on the job to understand what is ‘normal’ for each unique ICS environment.

Darktrace’s AI learns the normal ‘patterns of life’ for every user, device, and controller across both OT and IT. By continuously analyzing data across organizations’ systems, the AI’s unique understanding of how each facet of a business and a dynamic workforce interacts ensures that any malicious activity is detected seconds after it emerges. In the case of EKANS, this self-learning approach would have identified a number of anomalous behaviors pertaining to the originally infected device, including beaconing to a rare destination and the unusual connections to encryption software.

Complementing Darktrace’s threat detection is the AI’s Autonomous Response abilities, which neutralize threats with surgical precision – allowing business activity to continue as normal. Autonomous Response has already proven itself successful in stopping ransomware attacks, preventing damaging operational outages at manufacturing facilities, hospitals, and municipalities around the world.

Conclusion

EKANS revealed that attackers are beginning to successfully target both IT and OT systems with one attack, making the need for security programs that can bridge this gap more urgent than ever. The ability to defend both environments with a single security solution ensures holistic protection for the entire organization. By correlating disparate data points across SaaS, email, cloud, traditional network, and OT environments, Cyber AI can identify and stop even the most sophisticated attacks.

The reality is that threats in the OT sphere will continue to evolve, becoming faster and more furious than ever. Given the potential damage ransomware can cause, security that can defend industrial systems along with dynamic workforces – detecting and stopping fast-acting threats across a complex business – has become more important than ever. The functionality of industrial systems depends on it.

‍