SCADA Hacking: Snake, a New Variant of Ransomware Targets The recent ransomware assault towards the Colonial Pipeline .

The US reminds SCADA Hacking: Snake, a New Variant of Ransomware Targets :

us that SCADA/ICS infrastructure isn’t always immune from ransomware attacks. In reality, this assault ought to remind us just how vulnerable business structures are to cyber attacks and the potential ramifications of such attacks. don’t forget, with SCADA/ICS systems you’re shielding the system. The process is some distance greater essential than the records and ransomware could be very effective at disrupting the procedure.

most ransomware up to now has been centered to conventional IT structures. similarly, earlier ransomware attacks took a shotgun method to objectives, in different words, ship out heaps or millions of assault vectors and wish that a few are successful. in the closing yr, those people employed protecting commercial structures have something new to worry about, a ransomware variant designed particularly for SCADA/ICS structures and centered particularly to a single target SCADA Hacking: Snake, a New Variant of Ransomware Targets !

enter SNAKE (EKANS)

In January 2020, a new ransomware malware turned into located inside the wild by way of the MlawareHunterTeam and despatched to Vitali Kremenz to reverse-engineer. It turned into written Google’s coding language, Golang, an increasingly more popular language for ransomware builders (possibly as it affords for pass-platform improvement). This ransomware turned into fast given the moniker, Snake, for the strings located a number of the code (it appends .EKANS to the document strings it encrypts).

This ransomware goals business structures mainly through;

concentrated on a particular domain or IP deal with SCADA Hacking: Snake, a New Variant of Ransomware Targets

targeting unique business methods

Like other ransomware, it encrypts crucial files, but first it kills the commercial strategies after which encrypts. in this manner, now not best are the files unavailable to the target, however the industrial methods are stopped and cannot be re-began without the decryption key. in the end, the attackers demand a ransom in tens of millions of greenbacks in place of masses of bucks like the standard ransomware so common at some point of the sector.

Anatomy of Snake

Snake is tailored to each commercial goal, so every one is slightly extraordinary. In this example, we can examine a version of Snake that was used to bring down the commercial operations of Honda, the japanese auto producer. On June 8, 2020, Snake introduced Honda’s operation in Japan and Europe to a screeching halt SCADA Hacking: Snake, a New Variant of Ransomware Targets .

because Snake is tailored in particular to the target, it can not be stated what its particular assault vector is. The attackers use a multitude of vectors to enter the machine including SCADA Hacking: Snake, a New Variant of Ransomware Targets ;

recognised vulnerabilities

Stolen Credentials

weak or mis-configured RDP

inside the case of the Honda attack, the assault vector changed into likely via RDP. different attacks can also contain the everyday ransomware vectors this kind of phishing and malicious documents. furthermore, in a few instances, Snake has exfiltrated facts earlier than the encryption manner starts SCADA Hacking: Snake, a New Variant of Ransomware Targets .

allow’s check how Snake does its dirty work SCADA Hacking: Snake, a New Variant of Ransomware Targets .

degree 1

to start, he Snake’s executables are just 3-4MB in size, written in pass, and are 32-bit and unsigned. whilst the executable is performed on the goal, the primary element it does is to make sure that it’s miles the most effective being run once through using mutex named “EKANS”.

next, it attempts to verify that it is within the right goal’s community by using the use of DNS and NETBIOS. If the call decision is unsuccessful, the malware really exits without encryption. The specificity of the assault is likewise meditated by the IP deal with of Honda performing in pc’s RAM SCADA Hacking: Snake, a New Variant of Ransomware Targets .

degree 2

earlier than Snake begins encryption, the malware uses the home windows firewall to dam any incoming or outgoing network connections the usage of the netsh command. Now with the outdoor world cutoff, it kills any tough-coded methods that could interfere with the encryption degree SCADA Hacking: Snake, a New Variant of Ransomware Targets .

stage three

Snake a has a hard-coded listing capacity commercial approaches together with GE Proficy, GE Fanuc, Honeywell’s HMI, Flexnet and others. It seems for these tactics and if they exist, it stops them. it is critical to word that Snake does not have the functionality of injecting instructions into those strategies which might be some distance greater malicious and could have devastating consequences. i would now not be surprised if we see that functionality or module brought in destiny variants of Snake.

Snake also eliminates the laptop’s Shadow quantity Copies and kills strategies related to digital machines (VMWare tools), and remote control gear and software.

stage 4

as soon as all this preparation is completed, Snake begins encryption. Snake uses AES-256 and RSA-2048. Snake uses the symmetric key for encrypting and decrypting and the key is encrypted with the attacker’s public key. The encryption method excludes all essential system files and folders so that the device can be used to pay the ransom. Like almost all different ransomware, it incorporates a tough coded list of record extensions to encrypt such square, document., xls, accdb, etc. The encrypted files’ strings are all appended with 5 characters (.EKANS).

degree 5

once all the files are encrypted, Snake all over again makes use of the netsh command to disable the firewall.

subsequently, the ransom notice is supplied to the goal.

summary

while ransomware has emerge as the scourge of our digital systems, a brand new variant threatens SCADA/ICS structures and infrastructure. Snake is ransomware that specially targets commercial systems and if effectively infecting an corporation can kill commercial strategies that can best be re-started out by using paying the ransom and decrypting the files.

Ransomware is one of the most devastating kinds of cybercrime. It’s not unusual for attackers to effectively extort substantial sums of money from their sufferers. every now and then, they extort sufferers for tens of millions of bucks, with some sufferers inclined to pay up as opposed to forget about the hazard of records loss or exposure.

at some point of this submit, we’re going to take an in-depth study 93 ransomware statistics for 2022, consisting of:

The variety of ransomware attacks which have taken area

The types of groups focused

Extortion costs (in terms folks bucks)

and much more

We’ve accrued information from the today’s industry reviews on cybersecurity. We also replace our statistics frequently to offer you the most up to date angle on ransomware, which includes how you can shield yourself.

the prevalence of ransomware assaults
here are the most critical data concerning the growth of ransomware in 2021 and 2022.

worldwide ransomware information through zone
among 2020 and Q2 2022, the extent of ransomware attacks peaked in Q2 2021 with 188.nine million assaults. [SonicWall]

Ransomware stays the most not unusual form of malware in 2022. It has grown in recognition because of its capacity to extort huge sums of cash while posing a low risk to cybercriminals. [Cybereason]

Ransomware is the second one leading motive of records breaches in Q1 2022, after phishing. [Identity Theft Resouce Center]

There have been 623.3 million ransomware attacks worldwide in 2021 and 304.6 million detected attacks in 2020. [Statista]

in the first 1/2 of 2022, there were 236.1 million ransomware tries. [Statista]

although the majority of machines targeted are home windows and Mac based, there has been a 146% increase in Linux ransomware. [IBM Security]

76% of businesses suffered one or greater ransomware attacks in 2021. of these seventy six%:

forty two% were by chance resulting from user actions, along with clicking on malicious hyperlinks from unsolicited mail emails.

forty three% have been due to negligence from managers or directors (dangers concerning software program patches, credentials, and many others.) [Veeam]

In 2021, hackers effectively encrypted records in 65% of attacks, up from fifty four% recorded in 2020. [Sophos]

In 2021, there was an 82% upward push in ransomware incidents, with 2,686 assaults rather than 1,474 in 2020. [CrowdStrike]

all through the first half of 2022, there were 707 ransomware attempts per enterprise. [SonicWall]

countries targeted through ransomware
Ransomware crook corporations specially goal richer nations to maximize earnings.

international locations most attacked by means of ransomware
As of 2021, america remains the sector’s main target of ransomware attacks, representing over 51% of incidents. the opposite countries consist of:

uk — 10%

Canada — 5%

France — 3%

Australia — 3%

Japan — 2.5%

Brazil — 2%

Germany — 2%

rest of the sector — 21% [BlackFog]

Industries focused by means of ransomware
although all industry sectors may be focused through ransomware, some industries are more vulnerable than others.

Sectors that ransomware affected the most
The sectors that ransomware affected the most in 2021 include criminal (92%), production (78%), financial offerings (seventy eight%), and Human assets (77%). [Cybereason]

Criminals used ransomware against 14 of the sixteen vital infrastructure sectors (US), which includes Emergency services, meals and Agriculture, IT, and authorities facilities. [Cybereason]

86% of personal area organizations reported that ransomware cost them dearly in phrases of revenue and/or business in 2021. [Sophos]

In 2021, the retail enterprise skilled the maximum great growth in ransomware — one hundred%. in comparison to 2020, the technology sector saw an 89% boom, and healthcare shot up through 30%. [BlackFog]

The impact of ransomware on corporations
companies suffering from ransomware suffer notable losses, inclusive of dropping millions of bucks, losing customers, or even losing employees.

The value of ransomware
here’s how much ransomware assaults cost organizations in 2021:

international ransomware damage cost
between 2015 and 2021, the worldwide fee of ransomware elevated dramatically: from $325 million in 2015 to $20 billion in 2021.

67% of affected corporations pronounced losses ranging from $1 million to $10 million from ransomware assaults. [Cybereason]

four% of affected organizations anticipated losses from $25 million to $50 million. [Cybereason]

Following a ransomware assault, 37% of respondents indicated their agency needed to fireplace personnel, that’s over 30% more than in 2021. [Cybereason]

35% of respondents skilled C-level resignations following a ransomware attack. [Cybereason]

33% of respondents had been forced to quickly prevent operations in 2022, up 7% factors from 2021. [Cybereason]

The range of businesses centered by using ransomware attacks grew by way of 33% within the first half of 2022 (73%) in comparison to 2021 (fifty five%). [Cybereason]

In 2021, about 66% of groups skilled losses due to ransomware, up from 37% in 2020. this is an boom of seventy eight% in 365 days, which indicates that adversaries are becoming a lot higher at launching huge-scale attacks. [Sophos]

The average length of a target enterprise changed into 15,581 personnel in 2021, a decrease of 31% compared with 2020. [BlackFog] SCADA Hacking: Snake

ninety% of these hit by ransomware in 2021 stated that their operations have been seriously disrupted. [Sophos]

The average price to a enterprise in 2021 to restore the effect of a ransomware assault become $1.four million. this is a extensive decrease from $1.85 million in 2020. [Sophos]

Of the businesses hit by using ransomware in 2021, 66% had been attacked 3 or greater times. more than 10 wonderful attacks impacted around 15% of agencies. [Proofpoint]

Ransom payments stats
a few companies pick to pay the ransom, even though it’s typically no longer advocated and even unlawful in some countries.

common ransom payments 2020 – 2023

the global average ransom price was over $200,000 within the first 1/2 of 2022. That’s almost the equal in comparison to 2021 — 204K — and significantly extra than the average in 2020 — 169K. [Coveware]

The median fee turned into under US$100,000 within the first half of of 2022. [Coveware]

Fewer groups paid a ransom in Q1 2022 (less than 50%) in comparison to Q1 2019 (eighty five%). [SonicWall]

In 2021, the number of sufferers paying $1 million for ransom tripled (eleven%) as compared to 2020. [Sophos]

the proportion of corporations paying much less than $10,000 dropped to at least one in 5 in 2021 from 1 in three in 2020. [Sophos] SCADA Hacking: Snake

the producing and manufacturing quarter skilled the very best average ransom bills in 2021 — $2.04 million. [Sophos]

the lowest average bills in 2021 have been in healthcare — 197K. [Sophos]

Ransomware information restoration data
groups either paid or had unique healing techniques to get their records back. right here are the records.

What befell after agencies paid the ransom call for
58% of victims paid their attackers in 2021. of these that paid:

fifty four% regained records after the first charge SCADA Hacking: Snake

32% regained get right of entry to after paying additional ransom demands

10% refused to pay greater and didn’t recover any information SCADA Hacking: Snake

4% paid but did no longer regain access to their statistics or structures. [Proofpoint]

In 2021, 99% of all companies affected by ransomware recovered as a minimum a number of their statistics, up barely from ninety six% in 2020. [Sophos]

simply four% of payers got their data returned in its entirety, down from 8% in 2020. [Sophos]

forty four% of the respondents whose corporation’s records were encrypted used numerous techniques to restore it with out paying. [Sophos]

Backups are the most popular method for improving information, with 73% of agencies with encrypted facts having backups. [Sophos] SCADA Hacking: Snake

80% of people who paid were hit via ransomware a second time. [Cybereason]

68% of payers were hit by means of ransomware less than a month later. The attackers demanded large sums of cash. [Cybereason]

44% of those groups paid the second one ransom. nine% have been asked to pay three times greater, which they did. [Cybereason]

88% of organizations centered for repeated attacks have over 1,500 personnel. [Cybereason]

42% of payers stated the fee ended in partial data restoration. [Cybereason]

seventy eight% of non-payers stated they absolutely restored encrypted information without receiving a decryption key from attackers. [Cybereason] SCADA Hacking: Snake

Why do organizations pay ransoms?

Why corporations pay ransoms
groups pay ransoms for an expansion of motives, together with:

forty nine% of corporations said they paid to avoid revenue losses. [Cybereason]

forty one% said the choice to hurry up restoration turned into the primary purpose for charge. [Cybereason]

27% stated they paid the ransom because they hadn’t made statistics backups. [Cybereason]

34% stated they didn’t have sufficient employees to strive recuperation well with out the assist of the attackers. [Cybereason] SCADA Hacking: Snake

28% said they paid the ransom to keep away from delays in recuperation that could bring about damage or demise. [Cybereason] SCADA Hacking: Snake

information exfiltration, additionally called unauthorized records elimination or movement, is another challenge for agencies. seventy seven% of all ransomware attacks came with threats to submit exfiltrated statistics if a ransom changed into now not paid. [Cybereason] SCADA Hacking: Snake

In fifty four% of records exfiltration cases, the exfiltrated records blanketed touchy customer facts; 34% turned into private Identifiable statistics (PII); 30% covered highbrow assets (IP); 27% was blanketed health data (PHI). [Cybereason]

In 1 in three information breaches regarding ransomware, facts was exfiltrated to China or Russia. [BlackFog]

Sources