InfoSecBulletin Cybersecurity for mankind
Bitdefender has released a decryptor for the ShrinkLocker ransomware after months of concern from responders regarding attacks involving this malware. Bitdefender released a detailed blog explaining how a ransomware strain utilizes Microsoft’s BitLocker to encrypt files and removes recovery options.
“ShrinkLocker is a novel ransomware strain that leverages a unique approach to encrypt systems. By exploiting BitLocker, a legitimate Windows feature, it can rapidly encrypt entire drives, including system drives,” the company explained.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
The company started by investigating an incident where attackers targeted an unmanaged device in a Middle Eastern healthcare company and later spread within the system to deploy ShrinkLocker.
A new ransomware strain appeared earlier this year, attracting attention from researchers. Kaspersky reported its emergence in May, noting it targeted organizations in Mexico, Indonesia, and Jordan, impacting sectors like steel, vaccine manufacturing, and a government entity.
“Unlike most modern ransomware, which relies on sophisticated encryption algorithms, ShrinkLocker takes a simpler, more unconventional approach,” Bitdefender said.
“It first checks if BitLocker is enabled and, if not, installs it. Then, it re-encrypts the system using a randomly generated password.” After rebooting, the user must enter a password to unlock the drive, which then shows the attacker’s contact information and instructions to pay a ransom for the decryption key.
Bitdefender reports that ransomware can encrypt several systems in just 10 minutes per device.
The tool’s simplicity has drawn lower-level cybercriminals who prefer not to engage in larger ransomware operations. Researchers noted that it is easy to use and modify ShrinkLocker, allowing more attackers to access it.
“Our analysis shows that ShrinkLocker malware is being adapted by multiple individual threat actors for simpler attacks, rather than being distributed through a ransomware-as-a-service (RaaS) model,” they said.
The ransomware targets older systems, specifically Windows 7, 8, and Windows Server 2008 and 2012.
In May, Kaspersky’s Cristian Souza stated in a press release that BitLocker was initially created to reduce the risks of data theft or exposure. Two years ago, Microsoft reported that an Iranian state-sponsored group exploited the BitLocker feature in cyberattacks, a method also used by other cybercriminals.
“It’s a cruel irony that a security measure has been weaponized in this way,” Souza said. In the past two years, Bitdefender has released decryptors for three ransomware strains: LockerGoga, MortalKombat, and MegaCortex.
