What’s ShrinkLocker?
ShrinkLocker is a household of ransomware that encrypts an organisation’s knowledge and calls for a ransom cost with a view to restore entry to their recordsdata. It was first recognized by safety researchers in Might 2024, after assaults have been noticed in Mexico, Indonesia, and Jordan.
Up to now, so regular. What makes it noteworthy?
The ShrinkLocker ransomware is uncommon as a result of it makes use of VBScript and Microsoft Home windows’s reliable safety instrument BitLocker to help with the encryption of victims’ recordsdata.
Dangle on. You imply BitLocker, the full-disk-encryption characteristic that is purported to increase safety by stopping anybody with out correct authentication from accessing your recordsdata?
That is the one. Ironic is not it? BitLocker, for anybody who does not know, is a characteristic constructed into Home windows that makes use of robust encryption to scramble knowledge in your pc’s arduous drive. If you do not know the password to unlock a pc, you’ll be able to’t entry its knowledge.
Which is nice in case your laptop computer is stolen by a thief…
…however not so good if ShrinkLocker is the one which’s chosen to scramble your knowledge with Bitlocker, and never instructed you the password it used. Your pc will not have the ability to inform the distinction between you and a thief – and preserve you each locked out. Anybody beginning up the pc will likely be confronted with the usual BitLocker immediate for a password.
Has BitLocker been used on this approach earlier than by cybercriminals?
Sure, for example in January 2021 a Belgian hospital had 100TB of its knowledge encrypted on 40 of its servers utilizing BitLocker. The next yr a Moscow-based meat producer and distributor reportedly had its methods encrypted by a malicious attacker utilizing BitLocker.
Maybe essentially the most high-profile abuse of the built-in BitLocker instrument has been by the Iranian cybercrime gang Storm-0270 (also referred to as Nemesis Kitten), which Microsoft claimed in September 2022 had been chargeable for a number of ransomware assaults.
So, does ShrinkLocker go away a ransom observe?
No, as a substitute it adjustments the names of all your system drives to a contact tackle for the attacker.
So how do I get my fingers on the password with out paying up?
Sadly, the password used to encrypt your drive has been saved on the attacker’s personal server.
However the excellent news is that safety agency Bitdefender has launched a free decryption instrument that may assist ShrinkLocker victims get better their recordsdata.
Editor’s Observe: The opinions expressed on this visitor creator article are solely these of the contributor and don’t essentially replicate these of Tripwire.
