securelist · Crawled Jul 31, 2026

A new extortion cocktail: office printers, small ransoms, and BitLocker

1 IoCs 1 Malware
Read original article ↗

AI Summary

Two ransomware incidents in Colombia and Mexico involved attackers exploiting misconfigured RDP and MSSQL services to deploy BitLocker for data encryption and extortion. In the first case, attackers accessed an internet-facing RDP service, encrypted a critical 8TB drive, and printed ransom notes via corporate printers, demanding $3,000. In the second case, the 'XEntry Team' exploited a misconfigured MSSQL server with xp_cmdshell enabled, gained OS-level command execution, deployed RMM tools (including Mesh Agent and Tactical RMM), and used Group Policy Objects to mass-deploy BitLocker encryption across domain-joined systems. Victims were notified via blue screen messages and printed ransom notes. Both attacks leveraged built-in Windows tools to avoid reliance on traditional ransomware, indicating a shift toward low-cost, high-impact extortion using native encryption and remote management utilities.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware ShrinkLocker →

Indicators of Compromise 1 extracted

Type Value Detail
Filename web shell files Details →

MITRE ATT&CK TTPs 27 techniques

T1021.001 Remote Desktop Protocol · Lateral Movement T1059.001 PowerShell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1070.004 File Deletion · Defense Evasion T1070.008 Clear Mailbox Data · Defense Evasion T1072 Software Deployment Tools · Execution T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1105 Ingress Tool Transfer · Command And Control T1106 Native API · Execution T1110 Brute Force · Credential Access T1120 Peripheral Device Discovery · Discovery T1133 External Remote Services · Persistence T1136.002 Domain Account · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1176 Browser Extensions · Persistence T1197 BITS Jobs · Defense Evasion T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218.001 Compiled HTML File · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1491 Defacement · Impact T1566 Phishing · Initial Access