{"id":56146,"date":"2024-05-23T23:49:20","date_gmt":"2024-05-23T23:49:20","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/heres-yet-more-ransomware-using-bitlocker-against-microsofts-own-users\/"},"modified":"2024-05-23T23:49:20","modified_gmt":"2024-05-23T23:49:20","slug":"heres-yet-more-ransomware-using-bitlocker-against-microsofts-own-users","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/heres-yet-more-ransomware-using-bitlocker-against-microsofts-own-users\/","title":{"rendered":"Here’s yet more ransomware using BitLocker against Microsoft’s own users"},"content":{"rendered":"

Yet more ransomware is using Microsoft BitLocker to encrypt corporate files, steal the decryption key, and then extort a payment from victim organizations, according to Kaspersky.<\/p>\n

The antivirus maker’s Global Emergency Response team spotted the malware, dubbed ShrinkLocker, in Mexico, Indonesia, and Jordan, and said the code’s unnamed operators targeted steel and vaccine manufacturing companies, plus a government entity.<\/p>\n

Criminals, including ransomware gangs<\/a>, using legitimate software tools is nothing new \u2014 hello, Cobalt Strike<\/a>. And, in fact, Microsoft previously said<\/a> Iranian miscreants had abused Windows’ built-in BitLocker full-volume encryption feature to lock up compromised devices. We can recall other strains of extortionware using BitLocker on infected machines to encrypt data and hold it to ransom.<\/p>\n