Here's yet more ransomware using BitLocker against Microsoft's own users

Yet more ransomware is using Microsoft BitLocker to encrypt corporate files, steal the decryption key, and then extort a payment from victim organizations, according to Kaspersky.

The antivirus maker's Global Emergency Response team spotted the malware, dubbed ShrinkLocker, in Mexico, Indonesia, and Jordan, and said the code's unnamed operators targeted steel and vaccine manufacturing companies, plus a government entity.

Criminals, including ransomware gangs, using legitimate software tools is nothing new — hello, Cobalt Strike. And, in fact, Microsoft previously said Iranian miscreants had abused Windows' built-in BitLocker full-volume encryption feature to lock up compromised devices. We can recall other strains of extortionware using BitLocker on infected machines to encrypt data and hold it to ransom.

With ShrinkLocker, however, "the adversary took additional steps to maximize the damage from the attack and hinder an effective response to the incident," Kasperky threat hunters Cristian Souza, Eduardo Ovalle, Ashley Muñoz, and Christopher Zachor said in research published Thursday. The write-up includes technical details for detecting and blocking ShrinkLocker variants.

The Register has reached out to Redmond for comment, and will update this story if and when we hear back.

Once they've got code execution on a victim's machine, the data thieves deploy ShrinkLocker, which uses VBScript to probe Windows Management Instrumentation to determine the operating system version. It does this so that it selects the correct steps for whichever Microsoft OS is running, allowing it to extort current systems as well as those dating back to Windows Server 2008.

As for those steps, the script performs disk resizing operations (this is the "Shrink" part of ShrinkLocker) on fixed rather than network drives (presumably to minimize detection), rejigs the partitioning and boot setup, ensures BitLocker is up and running, and ultimately encrypts the computer's storage. See the Kaspersky report for how that works specifically for each flavor of Microsoft's operating systems.

Additionally, the malware changes the label of partitions to the extortionists' email, which allows the victim to contact the crooks.

After sending the decryption key needed to access the scrambled drives to a server controlled by the criminals, the malware deletes the key locally, trashing the user's recovery options, along with system logs that may help network defenders more easily spot or analyze the attack.

Finally, it shuts down the compromised system and displays the BitLocker screen with a message: "There are no more BitLocker recovery options on your PC." Game over.

In addition to listing ShrinkLocker's indicators of compromise, and suggesting organizations use managed detection and response products to look for threats, cough, Kaspersky recommends businesses take steps to avoid falling victim to these ransomware infections.

This includes limiting user privileges so they can't enable encryption features or modify registry keys. And if you do have BitLocker enabled, use a strong password and store recovery keys securely.

Also, monitor for VBScript and PowerShell execution events, and log as much critical system activity as possible to an external repository that can't be deleted locally.

Plus backup systems and files frequently, store them offline, and make sure to test them to ensure they can be recovered in the event of ransomware or some other security snafu. ®