EXECUTIVE SUMMARY
Attackers continuously find inventive ways to bypass security defenses, using techniques like packers, crypters, and code obfuscation. One of the most notable strategies involves leveraging the operating system's features to evade detection. Recently, we have observed threat actors using the native BitLocker feature to encrypt entire volumes and steal decryption keys. Originally designed to protect against data theft from lost or stolen devices, BitLocker is being maliciously repurposed, as evidenced by a sophisticated VBS script encountered in a recent incident response engagement. This script, dubbed "Shrinklocker," was detected in multiple countries, including Mexico, Indonesia, and Jordan, its widespread impact.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
Attackers continuously find inventive ways to bypass security defenses, using techniques like packers, crypters, and code obfuscation. One of the most notable strategies involves leveraging the operating system's features to evade detection. Recently, we have observed threat actors using the native BitLocker feature to encrypt entire volumes and steal decryption keys. Originally designed to protect against data theft from lost or stolen devices, BitLocker is being maliciously repurposed, as evidenced by a sophisticated VBS script encountered in a recent incident response engagement. This script, dubbed "Shrinklocker," was detected in multiple countries, including Mexico, Indonesia, and Jordan, its widespread impact.[emaillocker id="1283"]
The Shrinklocker VBS script operates by querying the operating system via Windows Management Instrumentation (WMI) to verify the system domain and check the OS version. If the system meets specific criteria, the script proceeds with disk resizing operations, focusing on local drives (DriveType = 3). It manipulates partitions to create unallocated space, formats new partitions, and reinstalls boot files using utilities like diskpart and bcdboot. The script modifies registry settings to configure BitLocker without TPM chips, ensuring compatibility across various Windows versions. Following this, it deletes BitLocker's default protectors and generates a random encryption key using system-specific data. This key is then sent to the attacker through an HTTP POST request. To cover its tracks, the script clears event logs, deletes scheduled tasks, and forces a system shutdown, leaving the victim with a coded drive.
This incident highlights the evolving tactics of cybercriminals who exploit legitimate OS features for malicious purposes. The Shrinklocker attack demonstrates a deep understanding of Windows internals, enabling efficient encryption of victim systems while evading detection. To mitigate such threats, organizations should use robust EPP solutions, implement MDR, enforce minimal user privileges, enable comprehensive network logging, and monitor VBS and PowerShell activities. Regular backups stored offline are crucial for recovery. Behavioral analysis remains the most effective detection method, as attackers can easily modify unique strings to bypass traditional detection rules.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Execution | T1047 | Windows Management Instrumentation |
| Defense Evasion | T1112 | Modify Registry |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1486 | Data Encrypted for Impact |
| T1529 | System Shutdown/Reboot |
REFERENCES:
The following reports contain further technical details:
https://www.theregister.com/2024/05/23/ransomware_abuses_microsoft_bitlocker/
[/emaillocker]