SC-011: OT/ICS Ransomware — Manufacturing Plant¶

Threat Actor Profile¶

CARBON WRENCH (internal tracking; overlaps with public reporting on Cl0p industrial affiliates) is a ransomware affiliate operating under a RaaS model. Unlike generic ransomware actors, CARBON WRENCH purchases access from Initial Access Brokers (IABs) specifically seeking industrial organizations. They use an ICS-aware variant of LockBit 3.0 modified to skip files matching *.prj, *.rtu, *.plc, *.tag, and *.cip extensions — preserving PLC logic files to avoid triggering immediate physical safety events that would complicate negotiations.

The group's playbook: encrypt IT + OT historian layers, display ransom note on HMI screens for psychological impact, exfiltrate operational data (recipes, safety setpoints, maintenance logs) for double extortion, demand $800K–$5M in Monero. Average dwell time before encryption: 5–14 days (shorter than APT; goal is financial, not espionage).

Scenario Narrative¶

Phase 1 — IT Foothold via Phishing (~30 min)¶

A maintenance engineer at Contoso Manufacturing's Springfield plant receives a phishing email impersonating a spare parts vendor, with a malicious Excel macro attachment (Hydraulic_Parts_Quote_March.xlsm). The engineer opens the file and enables macros. A PowerShell cradle downloads and executes a Cobalt Strike beacon staged on hxxps://185.220.101.47/logo.png (polyglot PNG/shellcode). The beacon establishes persistence via a scheduled task: \Microsoft\Windows\SyncCenter\SyncCenter.

The engineering workstation (EWS-PROD-01) sits in the OT DMZ — it has legitimate network access to both corporate IT (for parts ordering) and the SCADA/historian network. This is the IT/OT network bridge the attacker exploits.

Evidence Artifacts:

Phase 2 — IT-to-OT Pivot via SCADA Historian (~40 min)¶

With EWS-PROD-01 compromised, the attacker uses Cobalt Strike's jump winrm64 to pivot to HIST-01 — the OSIsoft PI System historian server running Windows Server 2016 (missing 18 months of patches). HIST-01 aggregates real-time process data from all PLCs and HMIs on the plant floor. It is the highest-value IT/OT bridge system.

From HIST-01, the attacker enumerates the OT network (192.168.100.0/24) using native ping, arp -a, and a simple PowerShell TCP port scanner. They identify: - 4× HMI stations running GE iFIX (192.168.100.10–13) - 2× Siemens S7-300 PLC programming terminals (192.168.100.20–21) - The safety instrumented system (SIS) network appears isolated (no ping response from HIST-01) — but the attacker cannot confirm this

Evidence Artifacts:

Phase 3 — Ransomware Deployment & HMI Display (~45 min)¶

On Day 5 of dwell, CARBON WRENCH deploys the ransomware payload. lockbit_ics.exe executes on HIST-01 and all reachable Windows hosts in the IT/OT DMZ. The ICS-aware variant skips *.prj, *.rtu, *.plc, *.tag files to avoid disrupting PLC logic directly. All other files are encrypted with AES-256 + RSA-4096.

Encrypted: the entire PI historian database (6 years of process data), maintenance records, batch recipe database, quality control records, and all backup files on \\BACKUP-SRV\hist_backup\ (the backup share was accessible from HIST-01).

The attacker accesses HMI-01 via RDP (default credentials unchanged: Administrator / admin123). They do not modify any PLC setpoints — instead, they display the ransom note as a full-screen browser popup on the HMI display visible to the plant floor. This forces the plant operator to manually initiate emergency shutdown (E-Stop) of the production line.

Evidence Artifacts:

Phase 4 — Recovery Decision & ICS-CERT Notification (~40 min)¶

The backup integrity check reveals the worst: all network-accessible backups were encrypted. The last known-good offline backup is a tape from 6 weeks ago — restoring from tape would lose 6 weeks of process recipe improvements, quality calibration data, and maintenance history.

Three recovery paths: 1. Pay ransom ($2.2M Monero): fastest recovery (~48h with decryptor), but funds criminal activity, no guarantee of decryptor working, FBI strongly discourages 2. Restore from tape (6-week-old backup): $2.3M/day production loss × estimated 5 days = $11.5M in downtime + 6 weeks of lost data 3. Professional recovery firm: ICS-CERT provides a referral — estimated 7–10 days, partial data recovery possible using forensic reconstruction of PI historian

ICS-CERT notification is mandatory under CISA advisories for OT ransomware affecting manufacturing. The FBI requests a copy of the ransom note and any attacker communications for attribution and cryptocurrency tracking.

Evidence Artifacts:

Detection Opportunities¶

Key Discussion Questions¶

1. The OT DMZ engineering workstation had unrestricted internet access. What is the minimum-privilege network architecture for an engineering workstation that needs vendor access?
2. HIST-01 was 18 months behind on patches. What is the appropriate patch management process for OT historian servers that cannot tolerate unplanned downtime?
3. The HMI used default credentials (admin/admin123). What CIS control or ICS security standard explicitly addresses default credential remediation on ICS devices?
4. All network-accessible backups were encrypted. What is the 3-2-1-1-0 backup rule, and how would it have changed the recovery options?
5. The plant operator made a safety decision (E-Stop) based on seeing the HMI ransom note. What pre-planned ICS incident response procedure would have guided this decision rather than leaving it to individual operator judgment?

Debrief Guide¶

What Went Well¶

• The Safety Instrumented System survived — physical isolation of the SIS network worked
• ICS-CERT was notified promptly and provided valuable recovery resources
• The plant operator correctly executed emergency stop procedures

Key Learning Points¶

• OT/IT convergence is the primary attack surface — the EWS bridge host was the entry point to OT; engineering workstations must be treated as high-value targets
• Patching OT systems requires a different process — not an excuse to skip it; work with vendor for maintenance window patching
• Default credentials on HMI/SCADA are unacceptable — a basic CIS/IEC 62443 control that is frequently missed
• Backup strategy must account for ransomware — network-accessible backups are not recovery backups; 3-2-1-1-0 rule requires offline/air-gapped copy
• SIS independence is your last line of defense — never assume SIS is safe because it "shows green" on a compromised network

Recommended Follow-Up¶

• [ ] Implement 3-2-1-1-0 backup strategy: include air-gapped/tape copy verified monthly
• [ ] Conduct OT network segmentation review — enforce Purdue Model or IEC 62443 zones
• [ ] Audit all OT/ICS devices for default credentials — remediate within 30 days
• [ ] Deploy OT-specific IDS (Claroty, Dragos, Nozomi) on ICS network
• [ ] Create and exercise an OT-specific Incident Response plan — separate from IT IR plan
• [ ] Establish OT patch management policy — quarterly patching for historian/HMI servers
• [ ] Contact ICS-CERT for free assessment resources and information sharing

References¶

• Chapter 21: OT/ICS/SCADA Security
• Chapter 23: Ransomware Deep Dive
• Chapter 9: Incident Response Lifecycle
• Chapter 15: Resilience, Tabletops & Learning