# Linux Ransomware Simulation Scripts

## Overview

The files in the `zvml-python-sdk/examples/ransomware` folder provide a set of scripts to simulate a ransomware-style
**encryption and decryption event** on a Linux VM. It is designed for use with **Zerto 10.0 U1+ (ZVML)** to demonstrate
ransomware detection and alerting capabilities—**without requiring any OVF templates or pre-built Windows VMs**.

This is a lightweight, Linux-native alternative to [RanSim](https://github.com/lawndoc/RanSim), ideal for fast
deployment and testing in Zerto-protected environments.

---

## Purpose

- Simulate encryption of user files to trigger Zerto’s ransomware detection engine.
- Demonstrate how ZVM (Zerto Virtual Manager) identifies abnormal encryption behavior.
- Provide a reversible, easy-to-run simulation environment using shell scripts.

---

## Prerequisites

- A Linux VM (Debian, Ubuntu, Rocky, RHEL, etc.)
- Zerto ZVML (Zerto Virtual Manager Linux) **10.0 U1 or later**
- A running VRA protecting the VM
- The VM must be part of an existing **Virtual Protection Group (VPG)**
- SSH or console access with write and execute permissions

---

## ZVM Tuning Parameters (Required)

Add the following parameters to `tweaks.txt` on your **ZVM appliance**, or apply them using ZVM’s backend interface:

```ini
t_ransomwareAttackThreshold=2
t_ransomwareEngTrainPeriodSec=60
t_ransomwareEngCuSumThrsDiff=5
t_ransomwareEngCuSumThrsSec=60
t_ransomwareEngAvgTimeSec=180
t_ransomwareEngCuSumTimeSec=2
```

> **IMPORTANT**: Restart the ZVM appliance (or the VM it's running on) to apply these changes.

---

## Recommended VM Configuration

- At least **90 GB** of total disk space
- Simulation dataset size: **~2 GB**

---

## Simulation Instructions

### 1. Clone the repository

```bash
git clone https://github.com/your-org/zvml-python-sdk.git
cd zvml-python-sdk/examples/ransomware
```

### 2. Create the test dataset

This command creates a folder containing 2000 files, each 1MB in size:

```bash
mkdir important-files
./create_data_set.sh 1M 2000 important-files
```

You can modify the size and number of files as needed.

### 3. Encrypt the dataset (simulate ransomware)

This encrypts all files in the folder using `openssl` and appends an `.encrypted` extension:

```bash
./encrypt_files_recursive.sh ./important-files yourkeyword encrypted
```

- `yourkeyword`: your encryption password
- `encrypted`: file extension to be appended (e.g., `.encrypted`)

> Within **30 to 60 seconds**, ZVM should detect abnormal behavior and trigger an alert.

### 4. Decrypt the dataset (restore files)

To reverse the simulation and restore the original files:

```bash
./decrypt_files_recursive.sh ./important-files yourkeyword encrypted
```

---

## Notes

- These scripts use `openssl` for AES-256 encryption.
- Make sure `openssl` is installed (`apt install openssl` or `yum install openssl` as needed).
- All operations are local to the Linux VM — no outbound internet or services required.
- You can modify or extend the scripts for more advanced or varied encryption behavior if needed.

---

## Disclaimer

This simulation is provided **for demonstration and educational purposes only**.  
Do **not** use these scripts on production systems or with sensitive/real data.  
Only use in controlled, isolated lab environments. Always inspect and understand what a script does before execution.

---

## Credits

- Based on concepts from [lawndoc/RanSim](https://github.com/lawndoc/RanSim)
- Adapted for Linux-based Zerto simulation environments by [Your Name or Team]
