--- title: "Snake/EKANS Ransomware Attacks Industrial Control Systems: Acronis Stops It" description: Ransomware continues to be an active, evolving threat, and Snake (or EKANS) is the latest strain to emerge canonical_url: https://www.acronis.com/en/blog/posts/snakeekans-ransomware-attacks-industrial-control-systems-acronis-stops-it/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Snake/EKANS Ransomware Attacks Industrial Control Systems: Acronis Stops It Ransomware continues to be an active, evolving threat and one of the newest strains to emerge is Snake (also known as EKANS, which is simply “Snake” spelled backward). First appearing at the end of December last year, the most interesting feature of Snake is that it targets industrial control systems (ICS) environments – not the individual machines, but the entire network. Designed to terminate specific processes on victim machines, including multiple items related to ICS operations, it also deletes Volume Shadow Copies to eliminate Window backups. While there is currently no decryption available, systems running Acronis Active Protection – the AI-based anti-malware defense that is integrated into our cyber protection solutions – successfully detects Snake ransomware as a zero-day attack and stops it in its tracks. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 6 min read Last updated 10 February 2020 Ransomware continues to be a very active, always evolving threat. One of the newest strains to emerge is Snake (also known as EKANS, which is simply “Snake” spelled backward). First appearing at the end of December last year, the most interesting feature of Snake is that it targets industrial control systems (ICS) environments – not the individual machines, but the entire network. The obfuscated ransomware sample, which was written in the Go programming language, was first observed in commercial malware repositories. It is designed to terminate specific processes on victim machines, including multiple items related to ICS operations, as well as delete Volume Shadow Copies to eliminate Window backups. While there is currently no decryption available, systems that are running [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/) – the AI-based anti-malware defense that is integrated into our [cyber protection solutions](https://www.acronis.com/en-us/cyber-protection/) – successfully detects Snake ransomware as a zero-day attack and stops it in its tracks. ### Infection process and some technical details The point of entry for Snake is an insecure RDP configuration. It is distributed via spam and malicious attachments, but also can be delivered via botnets, exploit packs, malicious ads, web injections, fake updates, and repackaged and infected installers. According to our analysis, when executed, Snake will remove the computer's Shadow Volume Copies and then kill numerous processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software, and so on. Deleting Windows backup copies is a set-up trend and expected functionality in any new ransomware. The ransomware checks for the existence of a Mutex value “EKANS” on the victim. If present, the ransomware will stop with a message “Already encrypted!”. Otherwise, the Mutex value is set and the encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations. Before proceeding to file encryption operations, the ransomware force stops (kills) any processes listed in a hard-coded list within the malware’s encoded strings. A full list with assessed process function or relationship is provided as follows: **Process** **Description** _bluestripecollector.exe_ _BlueStripe Data Collector_ _ccflic0.exe_ _Proficy Licensing_ _ccflic4.exe_ _Proficy Licensing_ _cdm.exe_ _Nimsoft Related_ _certificateprovider.exe_ _Ambiguous_ _client.exe_ _Ambiguous_ _client64.exe_ _Ambiguous_ _collwrap.exe_ _BlueStripe Data Collector_ _config\_api\_service.exe_ _ThingWorx Industrial Connectivity Suite, Ambiguous_ _dsmcsvc.exe_ _Tivoli Storage Manager Client_ _epmd.exe_ _RabbitMQ Server (SolarWinds)_ _erlsrv.exe_ _Erlang_ _fnplicensingservice.exe_ _FLEXNet Licensing Service_ _hasplmv.exe_ _Sentinel Hasp License Manager_ _hdb.exe_ _Honeywell HMIWeb_ _healthservice.exe_ _Microsoft SCCM_ _ilicensesvc.exe_ _GE Fanuc Licensing_ _inet\_gethost.exe_ _Erlang_ _keysvc.exe_ _Ambiguous_ _managementagenthost.exe_ _VMWare CAF Management Agent Service_ _monitoringhost.exe_ _Microsoft SCCM_ _msdtssrvr.exe_ _Microsoft SQL Server Integration Service_ _msmdsrv.exe_ _Microsoft SQL Server Analysis Services_ _musnotificationux.exe_ _Microsoft Update Notification Service_ _n.exe_ _Ambiguous_ _nimbus.exe_ _Broadcom Nimbus_ _npmdagent.exe_ _Microsoft OMS Agent_ _ntevl.exe_ _Nimsoft Monitor_ _ntservices.exe_ _Ambiguous_ _pralarmmgr.exe_ _Proficy Related_ _prcalculationmgr.exe_ _Proficy Historian Data Calculation Service_ _prconfigmgr.exe_ _Proficy Related_ _prdatabasemgr.exe_ _Proficy Related_ _premailengine.exe_ _Proficy Related_ _preventmgr.exe_ _Proficy Related_ _prftpengine.exe_ _Proficy Related_ _prgateway.exe_ _Proficy Secure Gateway_ _prlicensemgr.exe_ _Proficy License Server Manager_ _proficy administrator.exe_ _Proficy Related_ _proficyclient.exe_ _Proficy Related_ _proficypublisherservice.exe_ _Proficy Related_ _proficyserver.exe_ _Proficy Server_ _proficysts.exe_ _Proficy Related_ _prprintserver.exe_ _Proficy Related_ _prproficymgr.exe_ _Proficy Plant Applications_ _prrds.exe_ _Proficy Remote Data Service_ _prreader.exe_ _Proficy Historian Data Calculation Service_ _prrouter.exe_ _Proficy Related_ _prschedulemgr.exe_ _Proficy Related_ _prstubber.exe_ _Proficy Related_ _prsummarymgr.exe_ _Proficy Related_ _prwriter.exe_ _Proficy Historian Data Calculation Service_ _reportingservicesservice.exe_ _Microsoft SQL Server Reporting Service_ _server\_eventlog.exe_ _Proficy Event Log Service, Ambiguous_ _server\_runtime.exe_ _Proficy Related, Ambiguous_ _spooler.exe_ _Ambiguous_ _sqlservr.exe_ _Microsoft SQL Server_ _taskhostw.exe_ _Windows OS_ _vgauthservice.exe_ _VMWare Guest Authentication Service_ _vmacthlp.exe_ _VMWare Activation Helper_ _vmtoolsd.exe_ _VMWare Tools Service_ _win32sysinfo.exe_ _RabbitMQ_ _winvnc4.exe_ _WinVNC Client_ _workflowresttest.exe_ _Ambiguous_ While encrypting files on infected machine, it will skip the ones located in Windows system folders: _SystemDrive_ _:\$Recycle.Bin_ _:\ProgramData_ _:\Users\All Users_ _:\Program Files_ _:\Local Settings_ _:\Boot_ _:\System Volume Information_ _:\Recovery_ _\AppData\_ * _windir_ It will append a random five-character string to an encrypted file extension, as well as 'EKANS' file marker. The encryption process is typically slow and, in cases of actual infection, done in non-working hours. After finishing the encryption process, it will drop a ransom note named “Fix-Your-Files.txt” ![Image 3: Snake Ransomware Note](https://staticfiles.acronis.com/images/content/596ce80139fc0d2a28d7cf87bf999d13.png) Snake Ransomware Note User access to the encrypted system is maintained throughout the process, and the system does not reboot, shutdown, or close remote access channels. This differentiates Snake/ EKANS from more disruptive ransomware such as the LockerGoga. The email address in the ransomware uses a privacy-focused email service similar to Protonmail, called CTemplar. ### Acronis Active Protection detects from day zero Whereas previously ICS-specific or ICS-related malware was solely the playground of state-sponsored entities, Snake / EKANS appears to indicate that cybercriminals pursuing financial gain are now involved in this space as well. While this ransomware is still being analyzed for weaknesses, at this moment any data affected by it cannot be decrypted. The good news is that Acronis Active Protection is able to detect Snake and stop the malicious process in real-time, while also reverting any affected files. We only can imagine how much damage can be done if this strain makes its way into industrial environments, paralyzing traffic control systems or energy plants. ![Image 4: Detecting Snake Ransomware](https://staticfiles.acronis.com/images/content/51d373d2a9c094fef99b98baa84e84db.png) Detecting Snake Ransomware ![Image 5: Preventing attackes of Snake ransomware](https://staticfiles.acronis.com/images/content/dd57dbb4ff92a1c74ad5781a33fde186.png) Preventing attackes of Snake ransomware [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 6: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/nhs-cyber-attack/) [The NHS cyber attack](https://www.acronis.com/en/blog/posts/nhs-cyber-attack/) [Next post](https://www.acronis.com/en/blog/posts/acronis-connectwise-partnership/) [Acronis’ partnership with ConnectWise deepens with Acronis APIs, MSP cyber protection solutions](https://www.acronis.com/en/blog/posts/acronis-connectwise-partnership/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 7: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 8: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 9: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read