EKANS appears to be the work of cybercriminals, rather than nation-state hackers—a worrying development, if so.
https://www.wired.com/story/ekans-ransomware-industrial-control-systems
https://www.wired.com/story/ekans-ransomware-industrial-control-systems