There seems to be a snake in the grass causing disruptions at two well-known industrial enterprises, Japanese automobile manufacturer, Honda, and Energy Company, Enel Argentina.<\/p>\n\n\n\n
Here\u2019s what\u2019s been reported so far:<\/p>\n\n\n\n
The cyber attack is believed to be ransomware: a particularly nasty type of malware that aims to steal or encrypt data and threatens to expose it or continue to block access to it unless a ransom is paid.<\/p>\n\n\n\n
The attack has been tied to the Snake ransomware family \u2013 also known as \u2018EKANS<\/em>\u2019 (snake backwards) \u2013 which first reared its head in early 2020.<\/p>\n\n\n\n There are several reasons for the belief that Snake is behind the attack:<\/p>\n\n\n\n Snake ransomware is known for targeting large, Industrial Control System<\/strong> (ICS<\/strong>) environments, typically used in factories for automating processes. Snake ransomware can lock, shut down or even delete these ICS<\/strong> processes (effectively halting production for the victim company). It then encrypts data and demands a ransom for decryption. The reason ransomware like Snake targets larger organisations is to extort a greater ransom which is more likely to be paid; under mounting pressure from loss of production, the victim company must weigh up the cost of paying the ransom in the hope of recovering faster vs. withholding the ransom and losing out over extended downtime and a longer recovery period.<\/p>\n\n\n\n Snake ransomware is a hand-launched attack, as opposed to an automated one. The attacks on both Honda and Enel were first noticed on a Sunday; most human-controlled attacks are launched on weekends as their operators know there are likely to be fewer security personal on-hand during this time.<\/p>\n\n\n\n Honda suffered compromised connectivity and affected networks in Japan, the US and Europe. Enel also found its corporate network disrupted as a result of the attack. Human-operated attacks such as Snake ransomware often target an organisation and infiltrate the entire network by slowly gaining privileged access. This ensures maximum destruction when they launch the main part of the attack (in the case of Snake ransomware: encryption) and enables attackers to infect multiple devices across the network rather than impacting just one device.<\/p>\n\n\n\n Based on samples of the malware posted online, the ransomware appears to have been coded to target Honda and Enel\u2019s networks specifically:<\/p>\n\n\n\n 1. It checks for the internal network name of mds.honda.com and enelint.global before executing.<\/p>\n\n\n\n\n
\n
\n
\n