## 2 Related Work  
Ransomware is not a new cyberattack method, but it has evolved significantly over the years as related technologies have become more focused and sophisticated. The first known ransomware was observed in 1989, which the AIDS Trojan distributes. Despite the novelty of such an attack method, it was unsuccessful for various reasons [13]. Since then, ransomware attacks have grown increasingly ambitious and have mounted several high-profile, highly destructive attacks. The attack against Colonial Pipeline caused significant disruption and prompted concerns about the ICS security [14; 15]. Shortly after this, Ireland's national health service, the Health Service Executive, was hit with a ransomware attack that forced it to cancel thousands of appointments [16]. The ransomware attack is becoming a significant threat to enterprises and large organizations.  
Although there have not been any known ransomware attacks on PLCs in the real world, researchers have developed proof-of-concept attacks. The first known example of ICS ransomware against PLCs was LogicLocker [6], which can lock the PLC and replace programs with a logic bomb. Despite the novelty of Logic Locker, it has not explained more implementation details and depends on weak authentication vulnerabilities of specific PLC types. The first known full-fledged ICS ransomware, ICS-BROCK [11], presents some possible solutions to the physical isolation challenge and reduces reliance on vulnerabilities. However, ICS-BROCK required a precompiled payload based on the control logic, which is not typical for most ICS environments.  
On the PLC exploit side, Stuxnet is the first known example to target PLCs, which has destroyed Iranian centrifuges by tampering with the rotation speeds [17]. The PLCBlaster [18] can inject malicious code into PLC but focuses on destruction rather than extortion. [PERSON] first described the requirements for extending automated exploit frameworks to perform attacks against PLCs in [19]. The SABOT can dynamically generate attack payloads with little or no prior knowledge [20]. [PERSON] et al. researched PLC code layer vulnerabilities and proposed the PLC Security Framework (PLC-SF) [21]. [PERSON] [22] found vulnerabilities in Siemens S7 Comm protocol for a replay attack, which is also a reference of our research. Klick [23] proved that PLC could act as a proxy or scanner and be used by attackers to attack devices in a local network. There are also some DDoS attacks against common industry protocols [24] (e.g., insecure checksum validation during the update process [25]), which can cause an interruption on PLCs. Many automated exploit frameworks such as Metasploit [26] and Canvas [27] have been extended to attacks against PLCs. [PERSON] [28] targets the S7-300 PLC by injecting a Time-of-Day (TOD) interrupt code, which interrupts the PLC at a specific time the attacker wishes. [PERSON] [29] launched a stealth program injection attack on PLC with only a tiny modification. [PERSON] et al. [30] proposed a set of tools to symbolically analyze the software of PLC guided by an information flow analysis.  
All these above works are somewhat relevant to ours. However, this work is the first evaluation of these techniques.