Scarlet OT: OT Adversary Emulation For Fun And Profit

Scarlet OT: OT Adversary Emulation For Fun And Profit

Speakers: Sol Yang (Security Engineer); Vic Huang (UCCU)

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=VkreOTAfvw0

Overview

In the realm of industrial control systems (ICS) and operational technology (OT), the landscape of cybersecurity threats is rapidly evolving. Traditional IT security tools and methodologies often fall short in addressing the unique complexities and criticalities of OT environments. This talk, "Scarlet OT: OT Adversary Emulation For Fun And Profit," presented by Vic Huang from the Taiwanese technical community UCCU Hacker and Sol Yang, an independent researcher and security engineer, introduces a novel solution designed to bridge this gap. Their project, Scarlet OT, is an open-source adversary emulation tool specifically tailored for OT environments, aiming to empower organizations to proactively identify and mitigate vulnerabilities by simulating real-world ICS attacks.

The core motivation behind Scarlet OT stems from a recognized void in the security toolkit market: while numerous adversary emulation tools exist for the IT domain, very few are dedicated to OT. By meticulously analyzing historical ICS malware and extending their attack methodologies, the speakers have developed a flexible and modular platform. This tool not only reproduces known attack behaviors but also allows for the customization and combination of various attack techniques across multiple industrial protocols, providing a comprehensive framework for security testing.

The significance of Scarlet OT lies in its potential to revolutionize how critical infrastructure operators assess and strengthen their defenses. By enabling the emulation of sophisticated OT attack campaigns, from initial discovery and data collection to manipulation and evasion, Scarlet OT offers blue teams invaluable insights into their systems' resilience. The project's integration with existing IT adversary emulation platforms like MITRE Caldera further enhances its utility, providing a holistic approach to evaluating an organization's security posture across both IT and OT domains.

Background

▶ Watch: Introduction to Scarlet OT and adversary emulation (0:00)

Industrial Control Systems (ICS) are the backbone of modern society, managing critical infrastructure across sectors like energy, manufacturing, and water treatment. These systems are broadly categorized into SCADA (Supervisory Control and Data Acquisition) and DCS (Distributed Control Systems). DCS are typically used for fine-grained control within a localized plant, often employing vendor-customized protocols, while SCADA systems are designed for remote control over larger geographical areas, frequently leveraging publicly known control protocols. This distinction often leads security research to focus more on SCADA due to the accessibility of information regarding its protocols.

The architecture of IT and OT environments is commonly described using the Purdue Model, which delineates different layers from enterprise IT systems (Level 4/5) down to physical processes and sensors (Level 0). A DMZ (Demilitarized Zone) typically separates the IT and OT domains. Within the OT domain (Levels 0-3), devices like PLCs (Programmable Logic Controllers), HMIs (Human-Machine Interfaces), sensors, and IEDs (Intelligent Electronic Devices) communicate using specialized control protocols, distinct from standard IT network connections.

Adversary emulation is a proactive security exercise where known threat behaviors, tactics, techniques, and procedures (TTPs) of specific adversaries are simulated to test an organization's defenses. This process often leverages frameworks like the MITRE ATT&CK Matrix, which provides a comprehensive knowledge base of adversary TTPs. For ICS environments, the MITRE ATT&CK for ICS Matrix serves a similar purpose, detailing behaviors and targets specific to industrial attacks. Adversary emulation differs from penetration testing or red teaming in its focus on reproducing the entire attack process of a known threat actor, rather than simply identifying vulnerabilities. Such solutions are often referred to as Breach and Attack Simulation (BAS) tools. While the IT security market offers numerous BAS tools, a significant gap exists for robust, dedicated adversary emulation tools in the OT domain, a challenge Scarlet OT aims to address.

Key Findings

▶ Watch: Four key findings from past ICS malware analysis (12:00)

The development of Scarlet OT was informed by a thorough review and analysis of prominent ICS malware from 2010 to 2022, including infamous examples like Stuxnet (2010), HAVEX (2013), Industroyer/CrashOverride (2016), Triton/Trisis (2017), and PipeDream (2022). This analysis revealed several key trends and characteristics of ICS attacks:

The evolution of ICS malware can be broadly categorized into four generations:

1. First Generation (2011-2012): Focused primarily on data exfiltration and network sniffing.
2. Second Generation (2013-2016): Introduced modular designs, supporting multiple protocol attacks, and proof-of-concept exploits like PLC Blaster (abusing PLC connections).
3. Third Generation (2017 onwards): Saw the rise of ransomware targeting IT systems connected to OT, aiming for disruption and financial gain.
4. Fourth Generation (2020-2022): Characterized by high flexibility and sophisticated modular designs, capable of attacking a wider array of control protocols.

Across these generations, ICS malware generally pursues two main objectives: information collection and disruption of factory operations. The malware can be classified into three types:

• Worm-like malware (e.g., Stuxnet, HAVEX) focuses on spreading, hiding, and collecting information within the network.
• Ransomware targets specific processes on vulnerable Windows systems, encrypting data, and demanding payment to restore operations.
• Toolkits (e.g., PipeDream) are designed to directly attack various control protocols to manipulate or damage devices.

The speakers highlighted four critical observations from their malware analysis:

1. Limited Direct Device Attacks: Surprisingly, only a subset of ICS malware directly attacks OT devices. Many focus on compromising Windows-based systems within the OT network, such as HMIs or engineering workstations.
2. Hardcoded Targets: Several malware samples contained hardcoded target IP addresses and tag names. This suggests that attackers often possess prior, highly specific intelligence about the target environment, potentially indicating insider involvement or previous data breaches. Tag names, which represent objects within object-oriented control protocols, are usually unique to a specific system and not easily guessable.
3. PLC Mode Misconfiguration: For malware to upload malicious code to PLCs, these devices must be in a "program mode" rather than "run mode" or "hybrid mode." Changing PLC modes typically requires physical interaction with a button, implying either misconfiguration or an insider physically altering the device's state.
4. HMI/PLC Connection Topologies: In real-world factory deployments, HMIs and PLCs are predominantly configured in a one-to-one or one-to-multiple IP address connection. This finding casts doubt on the widespread applicability of attacks like PLC Blaster, which attempt to abuse connections between PLCs, suggesting such direct PLC-to-PLC communication might be less common in production environments.

Building on these insights, the speakers extended the MITRE ATT&CK ICS Kill Chain into a four-stage attack model focusing on two primary targets: data manipulation and control manipulation. This framework underpins Scarlet OT's design, enabling a structured approach to adversary emulation.

Technical Deep Dive

▶ Watch: Proposed four-stage ICS attack kill chain (14:50)

Scarlet OT's architecture is a direct response to the identified gaps and insights from ICS malware analysis. The tool's design philosophy centers on flexibility, modularity, and comprehensive emulation capabilities for OT environments.

The core objectives in building Scarlet OT were:

1. Reconstruction and Reproduction: To precisely replicate the actions observed in historical ICS malware campaigns.
2. Attack Extension: To go beyond simple data sniffing (a common malware behavior) to demonstrate active data manipulation and control over devices. This also includes extending attacks from single protocols to multiple.
3. Modularity and Granularity: To break down complex attack sequences into smaller, discrete steps that can be mapped directly to the MITRE ATT&CK ICS Matrix. This simplifies debugging and allows for greater customization.
4. Customizable Combinations: To enable users to combine different attack modules, reflecting the reality of multi-vendor OT environments where various protocols and device types coexist.
5. IT/OT Integration: Recognizing that OT attacks often begin with IT infiltration (as per the Purdue Model), Scarlet OT was designed to integrate with IT adversary emulation platforms. The speakers chose MITRE Caldera, an open-source adversary emulation platform focused on IT, and developed a dedicated plugin for OT attacks.

Scarlet OT currently supports 10 different industrial protocols and implements 23 distinct techniques, organized according to the four-stage attack model derived from their research:

1. Discovery Stage:

The objective here is to identify target devices within the OT environment.

• Data Target: Malware like Triton (2017) broadcasts specific "hello packets" to identify target devices that respond.
• Control Target: Standard tools like Nmap can scan for Modbus devices, often leveraging official function codes such as function code 17 (report slave ID) or function code 42 (read device identification) to discover available controllers.

2. Collection Stage:

This stage focuses on gathering information about the target devices or system status to prepare for manipulation.

• Data Target: Stuxnet famously sniffed PLC speed data for two weeks to establish baseline operating parameters (maximum and minimum speeds) before launching its destructive payload.
• Control Target: Malware like HAVEX (2013) enumerates OPC (OLE for Process Control) tags to understand the system's configuration and identify specific values to target.

3. Manipulation Stage:

This is where the actual impact on data or control systems occurs.

• Data Target: Attackers can manipulate data displayed on HMIs or stored in PLCs, leading operators to make incorrect decisions or triggering unintended protective actions. This could involve sending false alarms or muting legitimate alarms, causing operators to miss critical events.
• Control Target: This involves abusing normal function codes or exploiting existing vulnerabilities (CVEs). For example, Industroyer (2016) leveraged specific IEC 61850 instructions to damage electrical substation devices. PipeDream (2022) demonstrated sophisticated multi-protocol attacks to control entire environments.

4. Checking/Evasion Stage:

The final stage involves verifying the attack's success and covering tracks.

• Evasion: Some malware attempts to overwrite malicious code with meaningless data or uses "kill disk" functionalities to clean up logs, hindering forensic analysis.
• Control Target (Verification): A unique aspect in OT is the explicit re-checking of device status after sending a command. For instance, an attacker might send a "stop" command to a device and then immediately send a "check status" command to confirm the device has indeed stopped, ensuring the desired operational impact.

The integration with MITRE Caldera is a significant feature. Caldera provides the IT attack framework, and Scarlet OT acts as an OT-specific plugin. This allows users to chain IT-based initial access techniques with the OT-specific attacks provided by Scarlet OT, creating comprehensive, multi-domain adversary emulation scenarios that reflect real-world attack paths. The modular design, with payloads often written in Python and separated into small, manageable steps, enhances user customizability, allowing modifications to payloads, sequence changes, or the addition of new attacks.

Demo / Proof of Concept

▶ Watch: Demo: IEC 61850 GOOSE protocol alarm manipulation (27:00)

The speakers demonstrated Scarlet OT's capabilities through two distinct case studies, showcasing attacks against real industrial protocols. While the demo videos were not included in the conference recording, the presenters meticulously walked through the attack process and its observed effects.

1. IEC 61850 Case Study (Goose Protocol Manipulation)

The first demonstration focused on manipulating the IEC 61850 standard, which is widely used in electrical substation environments. IEC 61850 encompasses three main protocols: NS protocol for controlling devices, SV protocol for measuring device values, and Goose protocol for publishing event alerts among IEDs.

The demo specifically targeted the Goose protocol. Goose operates by continuously broadcasting event messages. When no new events occur, old events are re-broadcast, potentially leading to an increase in the SQNum (Sequence Number) and StNum (State Number), which can indicate communication issues or failures if they increment too rapidly. When a new event happens, SQNum resets, and StNum increments. The goal of the attack was to sniff and fake these Goose values.

The technical approach involved:

• Sniffing Traffic: Capturing Goose packets on the network.
• Analyzing PDU Structure: Understanding the position of SQNum and StNum within the Goose PDU (Protocol Data Unit), as well as the content of the ODA (Object Data Access), which contains information about the event. Although the exact meaning of ODA content might require prior analysis, Goose messages clearly indicate whether an event has occurred using a boolean value.
• Flipping Boolean Values: The core manipulation involved altering the boolean value within the Goose message to artificially trigger an event or alarm.

The demo showed an attacker machine sniffing packets and an HMI displaying a simulated IEC 61850 case bay with three devices: "cup," "middle," and "button." The attack specifically targeted the "button" device. By manipulating the Goose packets, the Scarlet OT tool successfully triggered an alarm on the "button" device, causing its display to turn red. Crucially, this alarm indirectly triggered control actions in other upstream devices within the simulated environment, even though no direct control packets were sent to them. This highlights how manipulating event data can have cascading effects on the overall control system.

2. MELSEC (Mitsubishi Electric) Case Study (MC Protocol)

The second demonstration involved a Mitsubishi Electric IQ-R series PLC using the MC Protocol. The speakers outlined their general methodology for analyzing ICS protocols:

• Official Documentation Review: Reading user manuals to understand the protocol's functions.
• MITRE ATT&CK ICS Mapping: Mapping protocol functions to specific techniques defined by the MITRE ATT&CK for ICS Matrix.
• Focus Areas: Identifying how to identify the ICS protocol and how to utilize its functions to control devices, specifically focusing on the protocol function, device address, and data to be sent to the PLC.

A significant challenge highlighted in this demonstration was the environment-specific nature of device addresses. Unlike standard network IPs, the internal addressing scheme for devices within a PLC's memory or a specific industrial network often varies greatly between deployments. Without prior knowledge (e.g., from an insider or previous reconnaissance), an attacker would need to enumerate all possible addresses, which is time-consuming and prone to errors. For the demo, the speakers had pre-analyzed the protocol and knew the relevant device addresses to enable a direct, focused attack. This mirrors real-world incidents where attackers often possess specific information about the target's internal configuration.

The MELSEC demonstration reproduced a Stuxnet-like attack scenario using the MC Protocol. This involved:

• Finding the PLC: Discovering the target device on the network.
• Version Checking: Identifying the PLC's firmware version.
• Read/Write Device Addresses: Accessing and modifying specific memory locations or registers within the PLC.
• Abnormal Operation: Executing commands that lead to unintended or malicious operational changes.

The demo, though not visually presented in the recording, was described as successfully demonstrating the ability to replicate these Stuxnet-like actions against the MELSEC PLC, underscoring Scarlet OT's capability to simulate sophisticated, multi-stage attacks against a variety of industrial equipment.

Defensive Implications

▶ Watch: Q&A: Handling encrypted TCP/IP in OT environments (39:00)

The insights and capabilities offered by Scarlet OT provide critical defensive implications for organizations operating ICS/OT environments. Understanding how adversaries exploit these systems is the first step toward building resilient defenses.

Firstly, Scarlet OT emphasizes that ICS attacks often leverage either inherent functions of ICS protocols themselves or known vulnerabilities (CVEs). Defenders must therefore maintain a comprehensive inventory of their OT assets, regularly patch known vulnerabilities, and rigorously assess the security posture of all deployed industrial protocols. The ability of Scarlet OT to automate the simulation of these attacks allows blue teams to proactively identify exploitable weaknesses before adversaries do.

Secondly, the demonstrations highlight the challenge of alerting and blocking malicious activities in OT without disrupting critical operations. Traditional IT security measures, which might aggressively block suspicious traffic, could cause catastrophic failures in sensitive OT environments. Scarlet OT enables defenders to observe the impact of simulated attacks on their systems and tune their security tools (e.g., IDS/IPS, SIEMs) to generate meaningful alerts and implement precise blocking rules that minimize operational impact. This involves understanding the normal behavior of ICS protocols and detecting deviations.

Thirdly, the observations regarding hardcoded IPs/tag names and PLC mode misconfigurations underscore the importance of robust internal security practices. Organizations must implement strict access controls, monitor for unusual configuration changes, and conduct regular audits to detect potential insider threats or prior data leakage that could provide adversaries with critical intelligence.

Finally, the speakers acknowledged the inherent difficulty in fully understanding the impact of an adversary emulation on a live factory environment. To mitigate this risk and enable safer testing, they proposed the concept of a digital twin – a virtual replica of the physical factory. While digital twins present their own challenges in terms of fidelity and data synchronization, they represent a promising future trend for conducting comprehensive and safe adversary emulation without endangering real-world operations. This would allow organizations to simulate various attack scenarios and observe their full impact on the virtual plant, refining their defenses iteratively.

Key Takeaways

• Filling an OT Security Gap: Scarlet OT addresses the critical lack of dedicated adversary emulation tools for industrial control systems, providing a much-needed resource for OT security testing.
• Insights from ICS Malware Analysis: A decade of ICS malware (e.g., Stuxnet, Industroyer, PipeDream) reveals common attack patterns, including the prevalence of attacks targeting Windows systems within OT, the significance of prior intelligence (hardcoded IPs/tags), and specific operational considerations like PLC modes.
• Structured Attack Emulation: The tool implements a four-stage attack model (Discovery, Collection, Manipulation, Checking/Evasion) targeting either data or control, offering a comprehensive framework for simulating real-world ICS attack campaigns.
• Flexible and Integrated Platform: Scarlet OT, built as a plugin for MITRE Caldera, supports 10 industrial protocols and 23 techniques. This integration allows for seamless emulation of both IT and OT attack vectors, reflecting realistic threat scenarios.
• Demonstrated Impact on Critical Protocols: Proof-of-concept demonstrations successfully showed manipulation of IEC 61850 (Goose protocol) to trigger indirect control actions and replication of Stuxnet-like behaviors against MELSEC (MC Protocol), highlighting the tool's practical utility.
• Enhancing Defensive Posture: Scarlet OT empowers blue teams to test and validate their defenses against known adversary TTPs, fine-tune alerting mechanisms, and prepare for complex IT/OT attack scenarios, with digital twins offering a future pathway for safe, comprehensive testing.

About the Speaker(s)

Vic Huang is a prominent member of UCCU Hacker, a technical community based in Taiwan. His interests span diverse domains within cybersecurity, and he actively shares his research at various security conferences, including those held in Japan.

Sol Yang is an independent researcher and security engineer with a particular focus and interest in Operational Technology (OT) security. He has contributed to the cybersecurity community by sharing his research findings at several different conferences.