InfoSecBulletin Cybersecurity for mankind
Bitdefender has released a decryptor for the ShrinkLocker ransomware after months of concern from responders regarding attacks involving this malware. Bitdefender released a detailed blog explaining how a ransomware strain utilizes Microsoft’s BitLocker to encrypt files and removes recovery options.
“ShrinkLocker is a novel ransomware strain that leverages a unique approach to encrypt systems. By exploiting BitLocker, a legitimate Windows feature, it can rapidly encrypt entire drives, including system drives,” the company explained.
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
The company started by investigating an incident where attackers targeted an unmanaged device in a Middle Eastern healthcare company and later spread within the system to deploy ShrinkLocker.
A new ransomware strain appeared earlier this year, attracting attention from researchers. Kaspersky reported its emergence in May, noting it targeted organizations in Mexico, Indonesia, and Jordan, impacting sectors like steel, vaccine manufacturing, and a government entity.
“Unlike most modern ransomware, which relies on sophisticated encryption algorithms, ShrinkLocker takes a simpler, more unconventional approach,” Bitdefender said.
“It first checks if BitLocker is enabled and, if not, installs it. Then, it re-encrypts the system using a randomly generated password.” After rebooting, the user must enter a password to unlock the drive, which then shows the attacker’s contact information and instructions to pay a ransom for the decryption key.
Bitdefender reports that ransomware can encrypt several systems in just 10 minutes per device.
The tool’s simplicity has drawn lower-level cybercriminals who prefer not to engage in larger ransomware operations. Researchers noted that it is easy to use and modify ShrinkLocker, allowing more attackers to access it.
“Our analysis shows that ShrinkLocker malware is being adapted by multiple individual threat actors for simpler attacks, rather than being distributed through a ransomware-as-a-service (RaaS) model,” they said.
The ransomware targets older systems, specifically Windows 7, 8, and Windows Server 2008 and 2012.
In May, Kaspersky’s Cristian Souza stated in a press release that BitLocker was initially created to reduce the risks of data theft or exposure. Two years ago, Microsoft reported that an Iranian state-sponsored group exploited the BitLocker feature in cyberattacks, a method also used by other cybercriminals.
“It’s a cruel irony that a security measure has been weaponized in this way,” Souza said. In the past two years, Bitdefender has released decryptors for three ransomware strains: LockerGoga, MortalKombat, and MegaCortex.
