Skip to main content

SNAKE ransomware looks to encrypt an entire business network

(Image credit: Future)

A new ransomware family has been discovered that is being used to target and encrypt all of the devices on business networks.

The SNAKE ransomware is the latest example of enterprise targeting ransomware which is used by cybercriminals to infiltrate business networks, gather administrative credentials and encrypt the files of every computer on a network using post-exploitation tools.

Other notable enterprise targeting ransomware families include Ryuk, BitPaymer, DoppelPaymer, Sodinokibi, Maze, MegaCortex and Locker Goga.

SNAKE ransomware

The SNAKE ransomware was first discovered by the MalwareHunterTeam which then shared it with the ethical hacker Vitali Kremez in order to reverse engineer it. Kremez's analysis of the ransomware revealed that it is written in Golang and contains a higher level of obfuscation than is typical with these kinds of infections.

Once the SNAKE ransomware enters a business' network, it removes the Shadow Volume Copies stored on computers and then kills a number of processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software and more. The ransomware then encrypts the files on each device while skipping any files located in Windows system folders and other system files.

The SNAKE ransomware adds a random five character string to the file extension of each file it encrypts and it also changes the 'EKANS' file marker (EKANS is SNAKE in reverse) of every encrypted file.

Once a computer's files have been encrypted, the program creates a ransom note on a user's desktop named Fix-Your-Files.txt. The note itself contains an email address to contact the cybercriminals who will provide a decryption tool loaded with a private key created specifically for the user's network for a fee.

The SNAKE ransomware poses a major threat to corporate networks because it encrypts files on all of the computers on the network as opposed to just those on a single machine.

Via BleepingComputer

Anthony Spadafora

After living and working in South Korea for seven years, Anthony now resides in Houston, Texas where he writes about a variety of technology topics for ITProPortal and TechRadar. He has been a tech enthusiast for as long as he can remember and has spent countless hours researching and tinkering with PCs, mobile phones and game consoles.