Ransomware Attack Simulator (Safe Demo)

A professional, education-focused ransomware behavior simulator built with Python and PySide6.

This project demonstrates the ransomware attack lifecycle visually without performing any real encryption. It is designed for cybersecurity awareness sessions, demos, and classroom training.

Purpose

The simulator helps demonstrate:

• How ransomware discovers and processes victim files
• How attack progress appears from both attacker and victim views
• Why backups and incident response processes are critical
• How recovery can be performed in a controlled scenario

Safety Model (Critical)

This project is intentionally safe.

• No cryptographic encryption is applied to file contents
• No scanning of user home folders or external paths
• No modifications outside demo_victim_files/
• "Encryption" is simulated by renaming files with .locked
• "Decryption" is simulated by renaming files back to original names

Technology Stack

• Python 3.10+
• PySide6 (GUI)
• threading (simulation flow)
• sqlite3 (attack timeline logs)
• pathlib / os (filesystem operations)
• psutil (system telemetry panel)

Major Features

1. Attack Dashboard

• Status panel with files found, files encrypted, progress, and countdown
• Terminal-style attack feed
• Timeline log panel for event history
• Victim system information (computer name, OS, username, CPU, memory)

2. Animated Attack Graphics

• Custom computer/network propagation graphics
• Animated links and packet movement
• Live infection-state visualization tied to attack progress

3. Victim Explorer (Windows-like)

• Two-pane explorer layout:
  • Left: folder navigation tree
  • Right: detail grid (Name, Type, Status, Path)
• System-style folder/file icons
• File-type color cues
• Lock/unlock status updates in real time during attack and recovery

4. Ransom Screen + Payment Simulation

• Full-screen Windows-style ransom interface
• Countdown timer and wallet info
• Button: Pay Ransome & get decryption key
• Key display/input workflow
• Key validation required before decryption simulation starts

5. Recovery Controls

• Decrypt flow restores all .locked files
• Demo controls include:
  • Start Attack
  • Pause/Resume Simulation
  • Reset Demo
  • Decrypt Files
  • Generate New Victim Files

6. SQLite Event Logging

• Structured timeline event logging to SQLite
• Useful for replay, reporting, and educational walkthroughs

Project Structure

ransomware_simulator/
   main.py
   simulator.py
   file_generator.py
   encryption_simulator.py
   recovery_engine.py
   system_info.py
   database.py
   requirements.txt
   ui/
      dashboard.py
      controls.py
      ransom_screen.py
      computer_graphics.py
      victim_explorer.py
   demo_victim_files/
   database/
      events.db

How It Works

1. Generate 30-50 demo files across subfolders (Documents/Pictures/Finance/Work/Personal)
2. Start attack simulation
3. Discover files recursively under demo_victim_files/
4. Simulate encryption by renaming files to .locked with realistic delays
5. Create READ_ME_NOW.txt
6. Show ransom screen
7. Simulate payment to generate a decryption key
8. Submit valid key to trigger decryption simulation
9. Restore file names back to original

Installation

1. Create/activate a Python environment
2. Install dependencies:

pip install -r requirements.txt

Run

From the ransomware_simulator folder:

python main.py

Database Details

Database file:

• database/events.db

Table:

• events

Columns:

• id (INTEGER PRIMARY KEY AUTOINCREMENT)
• timestamp (TEXT)
• event_type (TEXT)
• description (TEXT)

Common event types include:

• ATTACK_STARTED
• FILE_DISCOVERED
• FAKE_KEY_GENERATED
• FILE_ENCRYPTED
• RANSOM_NOTE_CREATED
• PAYMENT_CONFIRMED
• DECRYPTION_KEY_ISSUED
• KEY_ACCEPTED
• RECOVERY_STARTED
• FILE_RESTORED
• RECOVERY_COMPLETED

Demo Scope and Boundaries

Only this folder is ever modified:

• demo_victim_files/

Nothing outside that folder is targeted by simulation logic.

Troubleshooting

• If launch fails, verify you are in the correct folder before running python main.py
• If dependencies are missing, rerun pip install -r requirements.txt
• If a previous run was interrupted, use Reset Demo to regenerate a clean victim state

Disclaimer

This software is for authorized cybersecurity education and training only. Do not use it to imitate or facilitate malicious activity on real systems.