{"id":33158,"date":"2020-02-12T02:54:00","date_gmt":"2020-02-12T07:54:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=33158"},"modified":"2020-02-12T02:54:00","modified_gmt":"2020-02-12T07:54:00","slug":"new-ransomware-doesnt-just-encrypt-data-it-also-meddles-with-critical-infrastructure","status":"publish","type":"post","link":"https:\/\/blog.cyberconservices.com\/index.php\/2020\/02\/12\/new-ransomware-doesnt-just-encrypt-data-it-also-meddles-with-critical-infrastructure\/","title":{"rendered":"New ransomware doesn't just encrypt data. It also meddles with critical infrastructure"},"content":{"rendered":"\n

By DAN GOODIN<\/a> – Over the past five years, ransomware <\/strong>has emerged as a vexing menace that has shut down\u00a0factories<\/a>,\u00a0hospitals<\/a>, and\u00a0local municipalities and school districts<\/a>\u00a0around the world. In recent months, researchers have caught ransomware<\/strong> doing something that’s potentially more sinister: intentionally tampering with industrial control systems that dams, electric grids, and gas refineries rely on to keep equipment running safely.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

A ransomware<\/strong> strain discovered last month and dubbed Ekans contains the usual routines for disabling data backups and mass-encrypting files on infected systems. But researchers at security firm Dragos found something else that has the potential to be more disruptive: code that actively seeks out and forcibly stops applications used in industrial control systems, which is usually abbreviated as ICS. Before starting file-encryption operations, the ransomware <\/strong>kills processes listed by process name in a hard-coded list within the encoded strings of the malware.<\/p>\n\n\n\n

In all, Ekans kills 64 processes, including those spawned by human-machine interfaces from Honeywell, the\u00a0Proficy Historian<\/a>\u00a0from General Electric, and licensing servers from GE Fanuc. The same 64 processes, it turns out, are targeted in a version of the\u00a0MegaCortex ransomware<\/strong><\/a>. That version first came to light in August. Read On:<\/a><\/p>\n\n\n\n