InfoSecBulletin Cybersecurity for mankind
Bitdefender has released a decryptor for the ShrinkLocker ransomware after months of concern from responders regarding attacks involving this malware. Bitdefender released a detailed blog explaining how a ransomware strain utilizes Microsoft’s BitLocker to encrypt files and removes recovery options.
“ShrinkLocker is a novel ransomware strain that leverages a unique approach to encrypt systems. By exploiting BitLocker, a legitimate Windows feature, it can rapidly encrypt entire drives, including system drives,” the company explained.
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
The company started by investigating an incident where attackers targeted an unmanaged device in a Middle Eastern healthcare company and later spread within the system to deploy ShrinkLocker.
A new ransomware strain appeared earlier this year, attracting attention from researchers. Kaspersky reported its emergence in May, noting it targeted organizations in Mexico, Indonesia, and Jordan, impacting sectors like steel, vaccine manufacturing, and a government entity.
“Unlike most modern ransomware, which relies on sophisticated encryption algorithms, ShrinkLocker takes a simpler, more unconventional approach,” Bitdefender said.
“It first checks if BitLocker is enabled and, if not, installs it. Then, it re-encrypts the system using a randomly generated password.” After rebooting, the user must enter a password to unlock the drive, which then shows the attacker’s contact information and instructions to pay a ransom for the decryption key.
Bitdefender reports that ransomware can encrypt several systems in just 10 minutes per device.
The tool’s simplicity has drawn lower-level cybercriminals who prefer not to engage in larger ransomware operations. Researchers noted that it is easy to use and modify ShrinkLocker, allowing more attackers to access it.
“Our analysis shows that ShrinkLocker malware is being adapted by multiple individual threat actors for simpler attacks, rather than being distributed through a ransomware-as-a-service (RaaS) model,” they said.
The ransomware targets older systems, specifically Windows 7, 8, and Windows Server 2008 and 2012.
In May, Kaspersky’s Cristian Souza stated in a press release that BitLocker was initially created to reduce the risks of data theft or exposure. Two years ago, Microsoft reported that an Iranian state-sponsored group exploited the BitLocker feature in cyberattacks, a method also used by other cybercriminals.
“It’s a cruel irony that a security measure has been weaponized in this way,” Souza said. In the past two years, Bitdefender has released decryptors for three ransomware strains: LockerGoga, MortalKombat, and MegaCortex.
