🛡️ BitLock Framework: Cryptovirology and C2 Ecosystem (PoC)

This repository contains a comprehensive Proof of Concept (PoC) designed for the study of modern threat architectures. The project simulates a fileless attack environment with a command and control (C2) infrastructure protected by elliptic curve cryptography and secure deletion protocols.

🔬 Attack Lifecycle Analysis

The system operates through a coordinated execution of three main modules, designed to evade traditional defenses and ensure key persistence on the server.

1. Volatile Infiltration (load.py)

The attack begins with a Stage 0 Stager. Its main function is EDR (Endpoint Detection and Response) evasion:

• Ephemeral Handshake: Generates a unique AES-256 key in RAM and transmits it to port 5001.
• Payload Encryption: The server encrypts the ransomware in real-time before sending, thwarting packet inspection by static signatures.
• In-Memory Execution: The payload is decrypted and compiled into bytecode directly in volatile memory.
• Anti-Forensics: Implements a secure_wipe to destroy the key and plaintext source code before invoking exec().

2. C2 Channel Establishment (BitLockC2Server.py)

The server acts as an armored vault for cryptographic asset management:

• Vault Hardening: The key database uses AES-256-GCM encryption with PBKDF2 derivation (480,000 iterations).
• Physical Security: The --del command triggers a data shredding algorithm that overwrites files with random garbage and uses os.fsync() to ensure hardware buffer flushing.

3. Target Encryption Engine (BitLock-client.py)

The injected module performs file encryption with military-grade standards:

• Hybrid Handshake: Implements ECDHE (Curve P-384) to achieve Perfect Forward Secrecy (PFS). It has automatic fallback to RSA-4096 if elliptic curve libraries are not present.
• Authenticated Encryption: Uses AES-GCM to ensure files cannot be altered or recovered without the original integrity signature.
• Intelligent Evasion: Skips critical system directories (Windows, /bin/, /etc/) to avoid OS collapse and ensure visibility of the result report.

📊 Flow Diagram (Data Pipeline)

graph TD
    A[Cliente: Ejecuta load.py] -->|1. Envía Clave Efímera| B(Servidor C2: Puerto 5001)
    B -->|2. Envía Payload Cifrado| A
    A -->|3. Descifra y Ejecuta en RAM| C[BitLock-Payload]
    C -->|4. Intercambio ECDHE| D(Servidor C2: Puerto 5000)
    D -->|5. Almacena Llave en Bóveda| E[(DB Cifrada PBKDF2)]
    C -->|6. Cifrado AES-GCM| F[Archivos .locked]
    C -->|7. Auto-destrucción| G[Proceso Finalizado]

⚙️ Technical Security Specifications

⚠️ Disclaimer (Ethical Hacking)

This project is strictly for educational and research purposes.

1. The use of this tool on systems without prior authorization is illegal and constitutes a cybercrime.
2. The author assumes no responsibility for damage to the user's or third parties' infrastructure.
3. If the user locks their own system due to a configuration error, they assume full technical and financial responsibility for data recovery.

Developed for offensive security research and critical infrastructure defense.