Virtual Event Today: Supply Chain Security Summit - Join Event In-Progress

Security Experts:

Connect with us

Hi, what are you looking for?



New Snake Ransomware Targets ICS Processes

A recently uncovered piece of file-encrypting ransomware, which some believe may be linked to Iran, has been targeting processes and files associated with industrial control systems (ICS).

A recently uncovered piece of file-encrypting ransomware, which some believe may be linked to Iran, has been targeting processes and files associated with industrial control systems (ICS).

Written in the Golang programming language and dubbed Snake, the ransomware has been used in targeted campaigns aimed at enterprises. According to SentinelLabs, which has seen attacks involving Snake for the past month, files encrypted by this ransomware are difficult or impossible to recover without paying the ransom demanded by the attackers.

Snake targets a wide range of files, but avoids encrypting system files and folders. However, before it starts encrypting files, it attempts to terminate processes associated with various types of programs, including system utilities, enterprise management tools and even ICS.

SentinelLabs has mentioned Honeywell’s HMIWeb display builder and Israel-based industrial cybersecurity firm OTORIO says a majority of the industrial processes targeted by Snake are associated with products made by GE.

OTORIO says Snake terminates a critical process for the GE Digital Proficy server, which enables connectivity to the Proficy HMI/SCADA, Manufacturing Execution Systems (MES), and Enterprise Manufacturing Intelligence (EMI) systems. Terminating this process could cause serious problems for operational teams.

“The potential damage of a Snake attack is significant,” says Dor Yardeni, head of incident response and threat Hunting at OTORIO. “Deleting or locking targeted ICS processes would prohibit manufacturing teams from accessing vital production-related processes, including analytics, configuration and control. This is the equivalent of both blindfolding a driver and then taking away the steering wheel”.

Both OTORIO and SentinelOne have pointed out that the ransom note dropped by Snake instructs victims to contact the attackers at the email address “bapcocrypt @” to purchase the decryption tool.

Snake ransomware

“bapcocrypt” may be a reference to the Bahrain Petroleum Company (Bapco), which hackers recently targeted using a piece of malware named Dustman. Dustman has been linked by Saudi Arabia’s National Cybersecurity Authority to ZeroCleare, a wiper that has been used to target energy and industrial organizations in the Middle East.

ZeroCleare has been linked to Iranian hacker groups, and experts believe Iranian threat actors could also be behind Snake. While SentinelOne says “there may very well be a relationship between the Snake and Dustman attacks,” OTORIO believes that Snake may have actually been used in an attack on Bapco.

Related: Realistic Factory Honeypot Shows Threats Faced by Industrial Organizations

Related: The Impact of Recycling on Industrial Cyber Security

Related: Hackers Behind Triton ICS Malware Hit Additional Critical Infrastructure Facility

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.