The Shrink Locker family of ransomware encrypts an organization’s data, then demands payment in exchange for restoring access to the compromised files. It wasn’t until May 2024 that safety experts first took notice, following reports of violent attacks in Mexico, Indonesia, and Jordan.
The ShrinkLocker ransomware stands out due to its unconventional approach, leveraging VBScript and Microsoft Windows’ built-in security feature BitLocker to encrypt victims’ files.
That is the one. Ironic is not it? BitLocker is a built-in Windows feature that leverages robust encryption to securely encrypt data on your laptop’s hard drive. If you’re unable to recall the password to access a PC, you’ll be unable to gain entry to its stored information.
However, things take a turn for the worse when ShrinkLocker, instead of being a trusted ally, decides to encrypt your files using Bitlocker without providing any guidance on the password it has chosen to secure your data. Will your laptop accurately distinguish between you and an unauthorized user, or will it leave you both locked out? When powering on your PC, you may encounter the familiar BitLocker prompt requesting a password.
As an example, in January 2021, a Belgian hospital was leveraging the encryption capabilities of BitLocker to protect patient data. Next year, a Moscow-based meat processor and distributor suffered a devastating blow when a malicious hacker exploited BitLocker encryption to lock down their operations.
The Iranian cybercrime group Storm-0270, also known as Nemesis Kitten, gained widespread notoriety for its misuse of BitLocker, a built-in Windows security feature.
The attackers gain control over your entire computer system when they adjust the name of your drive to a handle that is easily accessible to them.
Unfortunately, the password utilised to encrypt your drive has been stored on the assailant’s private server.
However, the excellent news is that safety agency Bitdefender has launched an application that may assist ShrinkLocker victims recover their files.