SNAKE ransomware looks to encrypt an entire business network

(Image credit: Future)

A new ransomware family has been discovered that is being used to target and encrypt all of the devices on business networks.

The SNAKE ransomware is the latest example of enterprise targeting ransomware which is used by cybercriminals to infiltrate business networks, gather administrative credentials and encrypt the files of every computer on a network using post-exploitation tools.

Other notable enterprise targeting ransomware families include Ryuk, BitPaymer, DoppelPaymer, Sodinokibi, Maze, MegaCortex and Locker Goga.

SNAKE ransomware

The SNAKE ransomware was first discovered by the MalwareHunterTeam which then shared it with the ethical hacker Vitali Kremez in order to reverse engineer it. Kremez's analysis of the ransomware revealed that it is written in Golang and contains a higher level of obfuscation than is typical with these kinds of infections.

Once the SNAKE ransomware enters a business' network, it removes the Shadow Volume Copies stored on computers and then kills a number of processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software and more. The ransomware then encrypts the files on each device while skipping any files located in Windows system folders and other system files.

The SNAKE ransomware adds a random five character string to the file extension of each file it encrypts and it also changes the 'EKANS' file marker (EKANS is SNAKE in reverse) of every encrypted file.

Once a computer's files have been encrypted, the program creates a ransom note on a user's desktop named Fix-Your-Files.txt. The note itself contains an email address to contact the cybercriminals who will provide a decryption tool loaded with a private key created specifically for the user's network for a fee.

The SNAKE ransomware poses a major threat to corporate networks because it encrypts files on all of the computers on the network as opposed to just those on a single machine.

Via BleepingComputer

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.