InfoSecBulletin Cybersecurity for mankind
Bitdefender has released a decryptor for the ShrinkLocker ransomware after months of concern from responders regarding attacks involving this malware. Bitdefender released a detailed blog explaining how a ransomware strain utilizes Microsoft’s BitLocker to encrypt files and removes recovery options.
“ShrinkLocker is a novel ransomware strain that leverages a unique approach to encrypt systems. By exploiting BitLocker, a legitimate Windows feature, it can rapidly encrypt entire drives, including system drives,” the company explained.
NVIDIA Releases Security Update For GPU Driver Vulnerabilities
‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA
159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure
NVIDIA NeMo Framework Vuln Allow Attackers RCE
Cisco Issued Urgent Security Advisories For Multiple Products
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
The company started by investigating an incident where attackers targeted an unmanaged device in a Middle Eastern healthcare company and later spread within the system to deploy ShrinkLocker.
A new ransomware strain appeared earlier this year, attracting attention from researchers. Kaspersky reported its emergence in May, noting it targeted organizations in Mexico, Indonesia, and Jordan, impacting sectors like steel, vaccine manufacturing, and a government entity.
“Unlike most modern ransomware, which relies on sophisticated encryption algorithms, ShrinkLocker takes a simpler, more unconventional approach,” Bitdefender said.
“It first checks if BitLocker is enabled and, if not, installs it. Then, it re-encrypts the system using a randomly generated password.” After rebooting, the user must enter a password to unlock the drive, which then shows the attacker’s contact information and instructions to pay a ransom for the decryption key.
Bitdefender reports that ransomware can encrypt several systems in just 10 minutes per device.
The tool’s simplicity has drawn lower-level cybercriminals who prefer not to engage in larger ransomware operations. Researchers noted that it is easy to use and modify ShrinkLocker, allowing more attackers to access it.
“Our analysis shows that ShrinkLocker malware is being adapted by multiple individual threat actors for simpler attacks, rather than being distributed through a ransomware-as-a-service (RaaS) model,” they said.
The ransomware targets older systems, specifically Windows 7, 8, and Windows Server 2008 and 2012.
In May, Kaspersky’s Cristian Souza stated in a press release that BitLocker was initially created to reduce the risks of data theft or exposure. Two years ago, Microsoft reported that an Iranian state-sponsored group exploited the BitLocker feature in cyberattacks, a method also used by other cybercriminals.
“It’s a cruel irony that a security measure has been weaponized in this way,” Souza said. In the past two years, Bitdefender has released decryptors for three ransomware strains: LockerGoga, MortalKombat, and MegaCortex.
