mrhOTshOT: Replaying the World’s Deadliest ICS Attacks — Complete IT+OT Kill Chains for 12 Real Malware Families
Every major ICS attack in the last decade — Stuxnet, BlackEnergy3, Industroyer, TRITON, FrostyGoop — succeeded not because of software vulnerabilities, but because industrial protocols were designed to trust any packet on the wire. Defenders have threat intelligence reports. What they don’t have is the ability to replay these attacks against their own infrastructure to validate detections, train responders, and test defenses.
We present **mrhOTshOT**, an open-source framework that faithfully emulates 12 real-world ICS malware families across the complete attack kill chain — from Windows exploitation and lateral movement through to physical process destruction at the protocol level. Each emulation generates the exact wire traffic that Dragos, Mandiant, and ESET analyzed in their original incident reports, while simultaneously executing the Windows-side IT phase that made these campaigns successful before they ever touched an ICS.
The framework covers **14 distinct industrial protocols** across 10 distributed PLCs: IEC-104, Modbus TCP, DNP3, IEC 61850 MMS, GOOSE, S7comm, BACnet/IP, TriStation, OPC-UA, OPC-DA, OMRON FINS, M-Bus, EtherNet/IP, and MELSEC MC. Every PLC runs the process type that protocol is actually used for in the real world — a heating district controller for Modbus, a safety instrumented system for TriStation, a centrifuge cascade for S7comm.
Unlike CTF-style attack demos that show a single exploit, every emulation in mrhOTshOT reproduces the complete adversary playbook: Windows initial access with real CVEs via Metasploit, lateral movement to engineering workstations, protocol-native OT payload delivery, and persistent process manipulation — all generating verifiable network traffic and authentic Windows event logs simultaneously.
We demonstrate all 12 attacks live, culminating in a Stuxnet simulation where three IR-1 centrifuges are destroyed in real time while the operator HMI, deceived by the S7 rootkit, shows normal operation throughout.
Malav Vyas – Palo Alto Networks
Hacker extraordinaire specializing in cracking Windows and IoT ecosystems. I craft exploits, unearth vulnerabilities, and push the boundaries of security research. When not breaking things, I’m building up the infosec community through Null, Bsides, and OWASP.
Asher Davila – Palo Alto Networks
Asher Davila is a security researcher at Palo Alto Networks specializing in reverse engineering, binary analysis, and malware threat intelligence. His core research focuses on dismantling emerging threats and finding zero-day vulnerabilities in OT, IoT, and medical devices. Alongside his vulnerability research, he explores the practical integration of AI-assisted tooling into manual disassembly environments to accelerate and scale threat analysis. He actively shares his findings with the global cybersecurity community and has presented his research at conferences including Defcon, Virus Bulletin, BSidesSF, Ekoparty, etc.