###### Abstract  
The Industrial Control System (ICS) is a public facility that provides services to lots of users; thus, its security has always been a critical factor in measuring its availability. Recently, a new type of attack on ICS has occurred frequently, which realizes the extortion of users by invading the information domain and destroying the physical domain. However, due to the diversity and unavailability of an ICS control logic, the targets of such attacks are usually limited to PCs and servers, leaving more disruptive attack methods unexplored. To contribute more possible attack methods to strengthen the immunity of ICS, in this paper, we propose a novel ransomware attack method named Industrial Control System Automatic Ransomware Constructor (ICS-ARC). Compared to existing ICS ransomware, ICS-ARC can automatically generate an International Electrotechnical Commission (IEC) compliant payload to compromise the Programmable Logic Controller (PLC) without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. To evaluate the attack capability of ICS-ARC, we built a tap water treatment system as the simulation experiment target for verification. The experimental results determine that ICS-ARC can automatically generate malicious code without the control logic and complete the attack against target PLCs. In addition, to assist the related research on future attacks and defenses, we present the statistical results and corresponding analysis of PLC based on Shodan. Industrial Control System; ransomware attacks; Programmable Logic Controller +
Footnote †: journal: Medical  
areas, such as water treatment, electricity, natural gas, and oil, the most critical is not data but rather the continued availability and safe operation of their facilities [6]. A malfunction threat or attack as shown in Figure 1[7,8] may cause substantive damages with economic and even life losses in the real world. More and more attackers have recognized the value of targeting organizations with little tolerance for downtime [9]. With higher financial profits in mind, it is foreseeable that the ICS will be the next target for ransomware. However, existing ICS ransomware mainly focuses on Personal Computers (PC) and servers (IT-focused), which has disruptive impacts on operations with limited effect [10]. Although some ICS ransomware research (ICS-focused) [6,11] can compromise ICS equipment, the control logic is always taken as prior knowledge. The control logic runs in ICS controllers, such as the Programmable Logic Controller (PLC), which dictates how the ICS operates and interacts with the physical world. With control logic, the adversary can construct sophisticated attack payloads and achieve a precise strike on the target. However, due to the peculiarities of the ICS environment, the control logic is usually unavailable. In most cases, only the most potent adversaries, e.g., insiders or nation states, can have the control logic in advance. The \"last mile\", how to implement ransomware attacks without a pre-known control logic, is still under struggle. To address such a challenge, we present ICS-ARC (Industrial Control System Automatic Ransomware Constructor), which is a novel ransomware attack method that targets PLCs. In contrast to existing ransomware, ICS-ARC can automatically construct malicious payloads and launch attacks without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. ICS-ARC proceeds with a ransomware attack in four steps. The first step is to download the control logic bytecode from the target PLC and decompile it into a logical model. Next, find the correct mapping between  
Figure 1: The Potential Threats and Attacks of ICS. specific ICS devices and variables by model checking. Again, instantiate the ransomware attack payload for the target PLC with the correct mapping. The malicious payload can be triggered at a specified time on the specified device. Finally, upload the malicious code to the target PLC.