ShrinkLocker ransomware scrambled your files? Free decryption tool to the rescue

Bitdefender has released a free decryption tool that can unlock data encrypted by the ShrinkLocker ransomware.

Bitdefender made the decryptor publicly available following an extensive analysis of the malware strain, which was uncovered in May and found to use VBScript and Microsoft Windows' built-in BitLocker encryption feature to scramble victims' files.

That’s a crude approach compared to those used by more modern ransomware strains. But Bitdefender reckons using these "relics from the past" makes ShrinkLocker "a surprisingly simple yet effective ransomware."

"By using a combination of Group Policy Objects (GPOs) and scheduled tasks, it can encrypt multiple systems within a network in as little as 10 minutes per device," explained Martin Zugec, technical solutions director at Bitdefender.

"This simplicity makes the attack particularly attractive to individual threat actors who may not be part of a larger ransomware-as-a-service (RaaS) ecosystem," he added in a Wednesday write-up.

Bitdefender's analysis includes a link to download its free decryption tool, which has been added to the security shop's collection of 32 previously released ransomware decryptors. The antivirus maker also details the full nine-step process to install the decryption software.

However, as Zugec warns, "decryptor tools are inherently reactive – often limited to specific timeframes or software versions."

Another thing to remember is that while decryptors can restore your data, they don't prevent future attacks or stop digital thieves from selling or leaking info they've already stolen.

"We strongly recommend reviewing our recommendations section for additional guidance, including specific tips on configuring BitLocker to minimize the risk of successful attacks," Zugec noted.

In May, Russian antivirus slinger Kaspersky spotted criminals using ShrinkLocker to target steel and vaccine manufacturers, plus government entities in Mexico, Indonesia, and Jordan.

Microsoft has also warned that Iranian miscreants had abused Windows' built-in BitLocker to encrypt compromised devices. ®