Snake

Snake, also known as EKANS, is a threat actor first identified by Dragos on January 6, 2020. This malicious entity is notorious for its deployment of ransomware and keyloggers, primarily targeting business networks. The Snake ransomware variant has been linked to Iran and exhibits an industrial focus, posing significant risks to critical infrastructure systems. Moreover, Snake's malware was initially developed for Windows but was later ported to Mac, expanding its potential victim base. The modus operandi of the Snake Keylogger involves a sophisticated phishing email campaign that lures victims into opening a malicious Excel document under the pretense of viewing details of a "balance payment." The document exploits known vulnerabilities to download an HTA file, which then uses multiple language scripts, such as JavaScript, VBScript, and PowerShell, to download the Snake Keylogger's Loader module. This keylogger establishes persistence on the victim's computer and conducts process hollowing to run its core module in a newly created process. Snake Keylogger is particularly invasive, collecting saved credentials from over 50 popular software programs including web browsers, email clients, IM clients, and FTP clients. It traverses all profile files in search of these saved credentials. Once harvested, these credentials are transmitted to the attacker via various methods, including FTP servers, email addresses, or even Telegram's bot over HTTP Post method. Notably, one variant of the Snake Keylogger sends data over SMTP, indicating the diverse tactics employed by this threat actor.