Abstract
—Ransomware has recently emerged as the trending
new business model for cybercrime with high-profile attacks on
hospitals revealing how profitable the technique can be when
used to hold operationally critical assets for ransom. Meanwhile,
industrial control system (ICS) networks are still struggling to
update their security practices due to the perceived absence of
threats and rarity of real-world ICS attacks. Recent reports sug-
gest that ICS networks may be the next domain that ransomware
is targeting, but to date all attacks have simply used standard
ransomware against personal computers with limited effect. In
this work, we develop the first known version of ransomware
that targets programmable logic controllers, discuss the economic
implications of such an attack, and lay out a generic framework
for ICS ransomware to aid in future study and defenses.
David Formby
Srikar Durbha
Raheem Beyah
School of Electrical and Computer Engineering
Georgia Institute of Technology
djformby@gatech.edu, sdurbha6@gatech.edu, rbeyah@ece.gatech.edu
Fortiphyd Logic
dformby@fortiphyd.com, rbeyah@fortiphyd.com