SNAKE ransomware looks to encrypt an entire business network
New enterprise targeting ransomware encrypts all of the computers on a company’s network
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A newransomwarefamily has been discovered that is being used to target and encrypt all of the devices on business networks.
The SNAKE ransomware is the latest example of enterprise targeting ransomware which is used by cybercriminals to infiltrate business networks, gather administrative credentials and encrypt the files of every computer on a network using post-exploitation tools.
Other notable enterprise targeting ransomware families includeRyuk, BitPaymer, DoppelPaymer, Sodinokibi, Maze, MegaCortex and Locker Goga.
SNAKE ransomware
The SNAKE ransomware was first discovered by theMalwareHunterTeamwhich then shared it with the ethical hacker Vitali Kremez in order to reverse engineer it. Kremez’s analysis of the ransomware revealed that it is written in Golang and contains a higher level of obfuscation than is typical with these kinds of infections.
Once the SNAKE ransomware enters a business' network, it removes the Shadow Volume Copies stored on computers and then kills a number of processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software and more. The ransomware then encrypts the files on each device while skipping any files located in Windows system folders and other system files.
The SNAKE ransomware adds a random five character string to the file extension of each file it encrypts and it also changes the ‘EKANS’ file marker (EKANS is SNAKE in reverse) of every encrypted file.
Once a computer’s files have been encrypted, the program creates a ransom note on a user’s desktop named Fix-Your-Files.txt. The note itself contains an email address to contact the cybercriminals who will provide adecryption toolloaded with a private key created specifically for the user’s network for a fee.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The SNAKE ransomware poses a major threat to corporate networks because it encrypts files on all of the computers on the network as opposed to just those on a single machine.
ViaBleepingComputer
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Anker Nebula Mars 3 review: A powerful and truly portable projector
