Hackers use the ShrinkLocker ransomware to deprave your BitLocker

ShrinkLocker is the title of the brand new ransomware that’s affecting Microsoft’s BitLocker. Like most ransomware, it encrypts company information, steals decryption keys, and asks you to pay a ransom to retrieve them. So, BitLocker isn’t protected on trendy gadgets.

International Emergency Response, the maker of the Kaspersky antivirus, found and named it. In keeping with them, the ransomware targets metal and vaccine manufacturing firms and governmental establishments from Mexico, Indonesia, and Jordan.

How did the hackers develop the ShrinkLocker ransomware?

Cybercriminals created the ShrinkLocker ransomware utilizing Visible Primary Scripting (VBScript), a deprecated programming language for automated duties and controlling functions on Home windows-based techniques. The ShrinkLocker script can confirm the present model of your Home windows. In keeping with Kaspersky, it might probably assault new and outdated techniques courting again to Home windows 2008.

The ShrinkLocker ransomware will delete itself in case your system doesn’t meet the necessities of the wrongdoer. For instance, in case your area doesn’t match the goal or your system is older than Vista, it gained’t have an effect on you.

In case your system is appropriate for the assault, ShrinkLocker will change your boot settings. Then, it’s going to use BitLocker to try to encrypt your partitions. Apart from that, it’s going to use the diskpart command to shrink your non-Home windows partitions. Afterward, it creates major volumes utilizing the unallocated house left and reinstalls the boot information on the brand new partitions.

The ransomware locks you out

ShrinkLocker can lock you out of your system as a result of it removes the security techniques of your BitLocker encryption key to stop you from recovering it. The ransomware removes the important thing out of your system after sending it to the hackers.

When the malware finishes its course of, it shuts down your system and leaves you with all drivers locked and and not using a solution to get well what’s misplaced. Additionally, it deletes the information and logs that would result in particulars in regards to the assault. On prime of that, in the event you try to open your system, it exhibits the next message: There aren’t any extra BitLocker restoration choices in your PC.

Finally, to guard your system and group from the ShrinkLocker ransomware, you should use an Endpoint Safety Platform (EPP) resolution. It should assist you to discover out if anybody tried to tinker together with your BitLocker, restrict customers, and monitor occasions associated to VBS and PowerShell.

Did you ever encounter a BitLocker malware? Tell us within the feedback.

Sebastian is a content material author with a want to be taught every thing new about AI and gaming. So, he spends his time writing prompts on numerous LLMs to know them higher. Moreover, Sebastian has expertise fixing performance-related issues in video video games and is aware of his approach round Home windows. Additionally, he’s fascinated with something associated to quantum expertise and turns into a analysis freak when he needs to be taught extra.