Malware

ShrinkLocker

Indicators of Compromise 1

Filename web shell files

MITRE ATT&CK TTPs 27

Remote Desktop Protocol

Lateral Movement

Clear Windows Event Logs

Defense Evasion

Defense Evasion

Clear Mailbox Data

Defense Evasion

Software Deployment Tools

System Information Discovery

File and Directory Discovery

Ingress Tool Transfer

Command And Control

Credential Access

Peripheral Device Discovery

External Remote Services

Deobfuscate/Decode Files or Information

Defense Evasion

Browser Extensions

Defense Evasion

Exploitation of Remote Services

Lateral Movement

Exploitation for Defense Evasion

Defense Evasion

Compiled HTML File

Defense Evasion

Group Policy Modification

Defense Evasion

Data Destruction

Inhibit System Recovery

Source Articles

A new extortion cocktail: office printers, small ransoms, and BitLocker

Two ransomware incidents in Colombia and Mexico involved attackers exploiting misconfigured RDP and MSSQL services to deploy BitLocker for data encryption and extortion. In the first case, attackers accessed an internet-facing RDP service, encrypted a critical 8TB drive, and printed ransom notes via corporate printers, demanding $3,000. In the second case, the 'XEntry Team' exploited a misconfigured MSSQL server with xp_cmdshell enabled, gained OS-level command execution, deployed RMM tools (including Mesh Agent and Tactical RMM), and used Group Policy Objects to mass-deploy BitLocker encryption across domain-joined systems. Victims were notified via blue screen messages and printed ransom notes. Both attacks leveraged built-in Windows tools to avoid reliance on traditional ransomware, indicating a shift toward low-cost, high-impact extortion using native encryption and remote management utilities.

securelist ·1w ago