Ransomware C2 Infrastructure — Educational Simulation

A sophisticated 3-tier ransomware architecture demonstrating real-world cyber threat infrastructure, secure command-and-control (C2) communications, and encryption lifecycle management. Built for academic and defensive security research at HELMo.

⚠️ Educational Use Only — This project simulates attack infrastructure to understand defensive countermeasures. Unauthorized distribution or malicious use is illegal.

📋 Overview

This system models a modern ransomware operation with:

• Malware Agent (ransomware/): File discovery, encryption, and victim fingerprinting
• Key Server (serveur_cles/): Centralized 512-bit key management and victim state tracking
• Frontend Server (serveur_frontal/): Multi-threaded victim interface and ransom negotiation
• Control Console (console_controle/): Operator dashboard for managing infected systems
• Secure Transport (utile/): TLS encryption, Diffie-Hellman key exchange, cryptographic utilities

Attack Lifecycle

1. Malware Agent runs on victim
   ↓ System fingerprinting (SHA256), disk enumeration
2. Establishes encrypted C2 tunnel to Frontend
   ↓ Diffie-Hellman DHKE, AES-256-GCM authenticated encryption
3. Frontend routes commands via secure channel to Key Server
   ↓ Request victim RSA public key for file encryption
4. Agent encrypts files with victim-specific key (state: CRYPT)
   ↓ Files locked, ransom demand displayed
5. Operator manages victims via Control Console
   ↓ Monitor victim states, issue decryption commands
6. Key Server generates decryption key on demand
   ↓ Change victim state to DECRYPT, issue key to agent
7. Victim decrypts files, payment confirmed

📁 Project Structure

.
├── ransomware/                   # Malware agent
│   ├── ransomware.py            # Main agent (file encryption, state management)
│   ├── message_ransomware.py     # Message protocol definitions
│   ├── demande_rancon.py         # Ransom demand display UI
│   └── config/
│       └── ransomware.cfg        # Agent configuration (C2 address, ports)
│
├── serveur_cles/                 # Key Management Server
│   ├── serveur_cles.py           # Core KMS logic (multi-threaded)
│   ├── create_schema.py          # SQLite3 database schema initialization
│   ├── populate_schema.py        # Seed test victims
│   └── script/
│       └── victims_schema.sql    # SQL schema (victim states, keys, logs)
│   └── data/
│       └── victims.sqlite        # Persistent victim database
│
├── serveur_frontal/              # Frontend Server (victim-facing interface)
│   └── serveur_frontal.py        # Multi-threaded server (TLS + message routing)
│
├── console_controle/             # Operator Control Console
│   └── console_controle.py       # Interactive CLI for incident management
│
├── utile/                         # Shared utilities
│   ├── network.py                # TLS/socket I/O, message serialization
│   ├── security.py               # Cryptographic operations (DHKE, AES-256-GCM)
│   ├── message.py                # Protocol message classes
│   ├── config.py                 # Configuration parsing
│   ├── data.py                   # Data models (Victim, Key, State)
│   └── __init__.py               # Package initialization
│
├── README.md                     # This file
└── .gitignore                    # Git ignore rules

🔐 Cryptographic Components

Secure Communication Pipeline

Diffie-Hellman Key Exchange (DHKE)

Victim ←→ Frontend
  1. Victim generates ephemeral DH keypair
  2. Sends DH public key to Frontend
  3. Frontend responds with own DH public key
  4. Both compute shared session key (256-bit)
  5. Authenticated encryption with AES-256-GCM

AES-256-GCM Authentication

All C2 traffic:
  - 256-bit symmetric key (derived from DHKE)
  - GCM mode for authenticated encryption
  - Prevents tampering, replay attacks, forgery

File Encryption

Each victim file:
  - Victim-specific 512-bit RSA key (generated server-side)
  - Files encrypted with victim's public key
  - Decryption key held on Key Server
  - Release on operator command only

Victim State Machine

PENDING  ─→ CRYPT  ─→ DECRYPT  ─→ PAID
         (awaiting)  (encrypted)  (redeemed)

SQLite3 tracks transitions, timestamps, and crypto material for forensics.

🚀 Quick Start

Prerequisites

• Python 3.8+
• PyCryptodome (for AES-256-GCM encryption)
• Linux/macOS (socket API; Windows requires minor modifications)

Installation

# Clone the repository
git clone https://github.com/Q240297/ransomware-c2-architecture.git
cd ransomware-c2-architecture

# Install dependencies
pip install -r requirements.txt --break-system-packages
# OR: pip install pycryptodome

Running the Infrastructure

1. Initialize Key Server & Database

cd serveur_cles
python3 create_schema.py      # Create victims.sqlite
python3 populate_schema.py    # Seed test data
python3 serveur_cles.py       # Start KMS on port 8443

Output:

[Key Server] Listening on 0.0.0.0:8443
[Key Server] Database initialized with test victims

2. Start Frontend Server

cd ../serveur_frontal
python3 serveur_frontal.py    # Start on port 8380

Output:

[Frontend] Listening for victims on 0.0.0.0:8380
[Frontend] Key Server connected to 127.0.0.1:8443

3. Run Malware Agent (Victim Simulation)

cd ../ransomware
python3 ransomware.py

Agent Actions:

• Fingerprints system (hostname, OS, hardware)
• Discovers target files (*.txt, *.pdf, *.doc in home dir)
• Establishes encrypted C2 tunnel
• Encrypts files & transitions to CRYPT state
• Displays ransom demand UI

4. Operator Control Console

cd ../console_controle
python3 console_controle.py   # Connect to Key Server on 127.0.0.1:8443

Available Commands:

1. List all infected victims (CRYPT, PENDING, DECRYPT states)
2. Display victim details (last seen, encrypted file count)
3. Issue decryption key (transition CRYPT → DECRYPT)
4. View operation logs (timestamps, state changes)

📊 Example Output

Victim Encryption Process:

[Ransomware] System fingerprint: DESKTOP-XYZ | Win10 | Intel i7
[Ransomware] Discovered 45 files for encryption
[Ransomware] Establishing encrypted C2 tunnel...
[Ransomware] DHKE completed ✓ Shared key: a7c3f...
[Ransomware] Requesting victim public key...
[Ransomware] Encrypting files: [████████████░░░░░░] 60%
[Ransomware] All files encrypted. State: CRYPT
[Ransomware] Displaying ransom demand...

Operator View:

=== Victim Management Console ===
Active Victims: 3
  1. DESKTOP-ABC (CRYPT)    | 128 files encrypted | Last seen: 2 min ago
  2. WORKPC-DEF (PENDING)   | Awaiting encryption | Last seen: 5 min ago
  3. SERVER-GHI (DECRYPT)   | Key issued         | Last seen: 1 min ago

Command: 1 [List all]
Command: 3 [Issue decryption] → DESKTOP-ABC
  ✓ Key generated and sent
  ✓ Victim state transitioned to DECRYPT

🔬 Technical Highlights

Multi-threaded Architecture

• Key Server: Thread pool for concurrent victim connections
• Frontend: Async socket handling with FIFO message queues
• Thread-safe state: Global victim database protected with locks

Cryptographic Robustness

• Diffie-Hellman prevents passive eavesdropping
• AES-256-GCM provides authenticated encryption
• 512-bit RSA keys resist brute-force attacks
• Constant-time comparisons for authentication

Forensic Logging

SQLite3 schema captures:

CREATE TABLE victims (
  hash TEXT PRIMARY KEY,        -- System fingerprint
  state TEXT,                   -- PENDING | CRYPT | DECRYPT | PAID
  encrypted_count INTEGER,      -- Number of files encrypted
  rsa_public_key BLOB,          -- Victim's encryption key
  rsa_private_key BLOB,         -- Server-held decryption key
  timestamp_created TEXT,       -- When first seen
  timestamp_last_seen TEXT      -- Last C2 contact
);

📚 Educational Applications

This project is ideal for:

✅ Understanding real ransomware attack chains
✅ Designing defensive countermeasures (EDR, C2 detection)
✅ Forensic analysis (identifying attack artifacts)
✅ Secure coding (cryptography, key management, state machines)
✅ Network security (C2 traffic patterns, encryption analysis)

⚠️ Legal & Ethical Notice

This simulation is for authorized educational and defensive research only.

• ✗ Do NOT use against systems you don't own
• ✗ Do NOT deploy as functional malware
• ✗ Do NOT share with unauthorized parties
• ✓ Do study attack/defense mechanisms
• ✓ Do develop detection signatures
• ✓ Do share findings responsibly within academic/corporate security teams

Unauthorized computer access is illegal under the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide.

👨‍💻 Authors

Ibrahim El Komey & Ayoub – Cybersecurity Students, HELMo
UE-14 Security Integration Project | Spring 2025
LinkedIn | GitHub

📄 License

Educational use only. Modification and study permitted; redistribution requires attribution.

---

Questions about architecture or defensive applications? Open an issue or contact the authors.