Today's cybersecurity headlines are brought to you by ThreatPerspective

ShrinkLocker Ransomware: A Novel Approach to Encrypting Windows Systems

The ShrinkLocker ransomware has been identified as a novel approach to encrypting Windows systems using BitLocker configurations. Developed by Bitdefender researchers, a decryptor for this strain of malware provides potential relief for victims of these attacks. Understanding the threat posed by ShrinkLocker is crucial in helping organizations protect themselves against future outbreaks.

The threat landscape has seen its fair share of ransomware attacks, but a recent discovery by Bitdefender researchers has shed light on a novel approach used by the ShrinkLocker ransomware. This unique strain of malware exploits the Windows feature of BitLocker to encrypt entire drives, including system drives, in a matter of minutes.

According to research published by Bitdefender, ShrinkLocker was first discovered in May 2024 by researchers from Kaspersky. Unlike modern ransomware strains that rely on sophisticated encryption algorithms, ShrinkLocker modifies BitLocker configurations to encrypt entire systems. This approach allows the malware to rapidly spread across a network, compromising multiple systems in as little as 10 minutes per device.

The malware works by first checking if BitLocker is enabled on the system. If not, it installs it. The next step is to re-encrypt the system using a randomly generated password, which is then uploaded to a server controlled by the attacker. To facilitate faster encryption, ShrinkLocker disables default protections and uses the ‘-UsedSpaceOnly’ flag to encrypt only occupied disk space.

One of the most critical aspects of ShrinkLocker's approach is its use of network traffic and memory data to generate a unique password for each system it targets. This makes brute-forcing the password nearly impossible, significantly increasing the malware's resilience against decryption efforts.

ShrinkLocker also deletes and reconfigures BitLocker protectors, complicating the recovery of encryption keys. After the system reboots, the user is prompted to enter the password to unlock the encrypted drive. The attacker’s contact email is displayed on the BitLocker screen, directing victims to pay a ransom for the decryption key.

According to a report by Bitdefender, ShrinkLocker can also encrypt multiple systems in a network using Group Policy Objects (GPOs) and scheduled tasks. This feature allows it to rapidly spread across a domain, compromising entire networks in a short amount of time.

Researchers speculate that the ransomware code may have originated from an older benign application written over a decade ago. However, this does not diminish the threat posed by ShrinkLocker, which can be used by individual actors or larger operations to compromise systems and demand ransoms.

Fortunately, researchers at Bitdefender were able to develop a decryptor for ShrinkLocker, providing a potential lifeline for victims of these attacks. The decryptor is designed to work in conjunction with BitLocker, allowing users to unlock encrypted drives and regain access to their data.

Additionally, the report recommends proactive monitoring of Windows event logs, particularly from the “Microsoft-Windows-BitLocker-API/Management” source. This can help organizations detect early stages of BitLocker attacks, such as when attackers test encryption capabilities. Furthermore, configuring Group Policy to store BitLocker recovery information in Active Directory Domain Services (AD DS) and enforcing the policy “Do not enable BitLocker until recovery information is stored to AD DS for operating system drives” can prevent unauthorized encryption.

ShrinkLocker marks a significant development in the world of ransomware attacks, highlighting the need for organizations to remain vigilant against evolving threats. As such, it serves as an important reminder to prioritize security measures and stay up-to-date on the latest developments in the field.