pip install red-specter-specter-crypt
Modern ransomware campaigns combine AI-generated social engineering, covert LLM-API command-and-control channels, double-extortion data staging, and automated lateral movement. Defenders building detection and response capabilities need to test against realistic simulations — not theoretical models. SPECTER CRYPT operationalises the full ransomware kill chain in a controlled, authorised red-team environment.
Ransomware operators route command-and-control traffic through legitimate LLM API calls — base64-encoded JSON payloads embedded in model prompts, responses carrying instructions. Whitespace steganography hides signals in normal text. API traffic blends with legitimate AI usage: no firewall blocks it.
Before any file is encrypted, production ransomware deletes Volume Shadow Copies via vssadmin and wmic, stops backup services, and removes restore points. Defenders who have not tested VSS destruction detection have a blind spot that ransomware actors exploit in every major campaign.
Exfiltrate high-value files before encrypting them. Victims face two pressure points: pay to decrypt, and pay to suppress publication. SPECTER CRYPT stages sensitive files, creates encrypted archives, and simulates the exfil channel — giving defenders realistic telemetry to tune detection rules against.
LLM-generated ransom notes are grammatically perfect, contextually tailored, and psychologically optimised. They reference specific files, quote revenue figures, and include negotiation portals. AI-written notes are harder for victims to dismiss — and require different detection and response playbooks.
Ransomware spreads laterally using harvested NTLM hashes — no plaintext password required. Impacket psexec and pass-the-hash techniques pivot from an initial foothold to every reachable host in minutes. Defenders need real propagation simulations to validate network segmentation and lateral movement detection.
Incident response drills without realistic artefacts — real encrypted files, real C2 traffic, real ransom notes — produce unrealistic outcomes. SPECTER CRYPT generates complete, signed evidence chains for IR team training, red-team exercises, and authorised penetration testing engagements.
Eight subsystems cover the complete ransomware kill chain — from initial reconnaissance through encryption, extortion, and lateral propagation. DESTROY-tier gates enforce authorisation requirements for the most destructive operations.
| # | Subsystem | Command | Gate | What It Does |
|---|---|---|---|---|
| 01 | RECON | specter-crypt recon | OPEN | Target environment enumeration. File system analysis, high-value file identification (office docs, databases, configs, credentials), network share discovery, connected host enumeration. Outputs target manifest for downstream subsystems. |
| 02 | SHADOW | specter-crypt shadow | INJECT | Backup and shadow copy destruction simulation. VSS deletion via vssadmin/wmic command generation, Windows backup service stop sequence, restore point removal. Dry-run mode generates command artefacts without executing; live mode requires explicit --confirm-inject flag. |
| 03 | EXFIL | specter-crypt exfil | INJECT | Pre-encryption data staging for double-extortion simulation. High-value file selection from RECON manifest, AES-256-CBC archive creation, staging directory management. Simulates exfiltration channel with configurable destination. Generates double-extortion evidence artefacts. |
| 04 | C2 | specter-crypt c2 | INJECT | LLM-API covert command-and-control channel. Two modes: base64_json (operator instructions encoded as JSON, embedded in LLM prompt payloads, decoded from model responses) and whitespace_stego (beacon signal encoded as Unicode zero-width characters in cover text). Supports OpenAI, Anthropic, Gemini. PCAP-compatible traffic generation. |
| 05 | RANSOM | specter-crypt ransom | INJECT | AI-generated ransom note production. LLM-authored notes in corporate, personal, and government templates — contextually tailored with target organisation name, file counts, and urgency framing. Negotiation bot portal URL generation (onion address format). Bitcoin/Monero payment address templating. |
| 06 | ENCRYPT | specter-crypt encrypt | DESTROY | AES-256-CBC file encryption with key escrow. Per-file IV generation, PKCS7 padding, .crypt extension appending. Master key stored in encrypted escrow file (RSA-wrapped or passphrase-derived). Selective targeting by file type, directory, or RECON manifest. Companion decrypt command for authorised recovery. |
| 07 | PROPAGATE | specter-crypt propagate | DESTROY | Lateral movement simulation via impacket. Two methods: psexec (service-based remote execution on SMB targets) and pass_the_hash (NTLM hash-based authentication without plaintext credentials). Target host list from RECON manifest. Deploys simulation payload to reachable hosts under authorised test conditions. |
| 08 | REPORT | specter-crypt report | OPEN | Ed25519-signed CryptReport (SCR-{hex12}). SHA-256 hash-chained evidence across all subsystem artefacts. MITRE ATT&CK TTP mapping. OWASP LLM taxonomy. Severity ratings per finding. JSON output with full artefact manifest for IR team handoff. |
Run the complete pipeline — recon to signed report — against an authorised target environment:
Real AES-256-CBC encryption — per-file IVs, PKCS7 padding, .crypt extensions. Master key in encrypted escrow. Companion decrypt command for authorised recovery after red-team exercises.
Two channels: base64_json encodes operator instructions in LLM prompts — decoded from model responses. Whitespace steganography hides beacon signals in Unicode zero-width characters inside normal cover text.
Every CryptReport cryptographically signed with Ed25519. SHA-256 hash-chained evidence across all artefacts. Tamper-evident by design. Unique report ID: SCR-{hex12}. IR team handoff ready.
OPEN (recon/report), INJECT (shadow/exfil/c2/ransom — --override), DESTROY (encrypt/propagate — --override --confirm-destroy). Ed25519 cryptographic gate enforced at each tier boundary.
SPECTER CRYPT implements two covert C2 channels using commercial LLM APIs as the transport layer. Both channels blend operator traffic with legitimate AI API usage — making them invisible to conventional network monitoring and firewall rules that trust LLM API endpoints.
SPECTER CRYPT implements production-grade AES-256-CBC encryption — the same cipher used by real ransomware families. Key escrow enables authorised recovery after red-team exercises. The decrypt command is always available to operators holding the escrow key.
SPECTER CRYPT is designed exclusively for authorised red-team exercises, penetration testing engagements, and ransomware defence validation in controlled environments. Use against production systems, unauthorised hosts, or without explicit written permission from the system owner is illegal and strictly prohibited. The encryption subsystem generates real encrypted files — always run in a dedicated test environment with full backups. Unauthorised use may violate Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation globally. SPECTER CRYPT is restricted to licensed operators with verified UNLEASHED credentials. Apache License 2.0.
SPECTER CRYPT performs live AES-256-CBC encryption, makes real LLM API calls for C2 channels, and executes real impacket lateral movement against authorised targets. Every subsystem connects to real infrastructure. UNLEASHED fires real payloads. Tests passing is not proof — live kill chain execution is.