InfoSecBulletin Cybersecurity for mankind
Bitdefender has released a decryptor for the ShrinkLocker ransomware after months of concern from responders regarding attacks involving this malware. Bitdefender released a detailed blog explaining how a ransomware strain utilizes Microsoft’s BitLocker to encrypt files and removes recovery options.
“ShrinkLocker is a novel ransomware strain that leverages a unique approach to encrypt systems. By exploiting BitLocker, a legitimate Windows feature, it can rapidly encrypt entire drives, including system drives,” the company explained.
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
ChatGPT Develops Exploit for CVEs Before Public PoCs Share
TP-Link Router Vulns Allow to Execute Malicious SQL Commands
SSL.com’s domain validation system’s bug found: Hacker exploited
Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals
Hackers Exploit Zoom’s Remote Control Feature for System Access
The company started by investigating an incident where attackers targeted an unmanaged device in a Middle Eastern healthcare company and later spread within the system to deploy ShrinkLocker.
A new ransomware strain appeared earlier this year, attracting attention from researchers. Kaspersky reported its emergence in May, noting it targeted organizations in Mexico, Indonesia, and Jordan, impacting sectors like steel, vaccine manufacturing, and a government entity.
“Unlike most modern ransomware, which relies on sophisticated encryption algorithms, ShrinkLocker takes a simpler, more unconventional approach,” Bitdefender said.
“It first checks if BitLocker is enabled and, if not, installs it. Then, it re-encrypts the system using a randomly generated password.” After rebooting, the user must enter a password to unlock the drive, which then shows the attacker’s contact information and instructions to pay a ransom for the decryption key.
Bitdefender reports that ransomware can encrypt several systems in just 10 minutes per device.
The tool’s simplicity has drawn lower-level cybercriminals who prefer not to engage in larger ransomware operations. Researchers noted that it is easy to use and modify ShrinkLocker, allowing more attackers to access it.
“Our analysis shows that ShrinkLocker malware is being adapted by multiple individual threat actors for simpler attacks, rather than being distributed through a ransomware-as-a-service (RaaS) model,” they said.
The ransomware targets older systems, specifically Windows 7, 8, and Windows Server 2008 and 2012.
In May, Kaspersky’s Cristian Souza stated in a press release that BitLocker was initially created to reduce the risks of data theft or exposure. Two years ago, Microsoft reported that an Iranian state-sponsored group exploited the BitLocker feature in cyberattacks, a method also used by other cybercriminals.
“It’s a cruel irony that a security measure has been weaponized in this way,” Souza said. In the past two years, Bitdefender has released decryptors for three ransomware strains: LockerGoga, MortalKombat, and MegaCortex.
