Segmentados Investigación y Análisis

This post presents some lines of action to be followed in the case of having fallen victim to Ekans ransomware. It describes in detail the prevention, identification and response phases to be carried out.

With the aim of increasing cybersecurity knowledge, INCIBE-CERT has published a series of webinars in video format, so that, in a light and entertaining way, knowledge and technical aspects of cybersecurity can be expanded in various areas of interest, for both INCIBE-CERT's technical audience and anyone interested in cybersecurity.

In this new blog entry, we will analyze the features and describe the operation of a new ransomware called Ekans, initially known as Snake, which has a very specific design, aimed at infecting and blocking Industrial Control Systems (ICS).

GNSS (Global Navigation Satellite System) technology is deeply integrated into society to meet geolocation and time measurement needs; it is considered one of the most reliable and it is a critical element for certain industrial sectors. However, due to the advancement of the technology and its widespread use, GNSS are being compromised by cybercriminals.

Sodinokibi uses the RaaS (Ramsonware as a Service) model, which favours its rapid spread. In this article we present some lines of action that should be followed in the case of having been a victim of this sophisticated malware or if it is suspected that it could have infected our systems.

In the last few days there have been various reports, both nationally and internationally, of a ransomware campaign called NetWalker, also known as Mailto or Koko, which appears to target healthcare centers, taking advantage of the current state of alarm declared as a result of the COVID-19 pandemic.

The ransomware attacks have experienced a great evolution from its beginnings, being able to identify a great amount of different families at the present time, many of them are highly sophisticated, with high propagation and persistence. In this blog we explain what is Sodinokibi and how it works.

Throughout the year 2019, we have worked on the detection, treatment and preparation of notices related to cybersecurity in industrial environments, classifying them based on the sector, manufacturer, criticality, etc. This article summarises this work and makes a brief prediction of the events that will take place in 2020.

Today, it is common to find SIEM deployed in the IT infrastructures of all kinds of organisations, to be able to monitor and analyse security alerts in applications, systems, network devices, etc. However, though time and resources are being invested in industrial environments, it is still unresolved.

The honeypots, the recommended requirements for their correct implementation, the different possible types and their evolution until today, where they are implemented forming a honeynet.

Perhaps, given the many important cybersecurity leaks and intrusions in recent years involving everything from social media accounts to critical infrastructure and classified military secrets, the attention paid to the Aurora vulnerability has not been proportional to its seriousness and systems affected. This is because it affects almost every electrical system in the world, and potentially any rotating equipment, whether it generates energy or is essential for an industrial or commercial installation. If the threat is so widespread, why isn’t the industry more worried and actively looking for solutions? From this article various possible reasons for this are given.

In the industrial world there are many communications including radio communications. This article aims to inform the reader about these types of communications available and some concepts to consider. Also, about cases of cyberattacks that have been detected in order to prevent them in the future.