The threat actors are using VBScript
– a programming language used to automate tasks on Windows computers – to
create a malicious script with previously unreported features to maximize the
damage of the attack, Kaspersky Global Emergency Response team reports. The novelty is that the script checks the current
version of Windows installed on the system and enables the BitLocker features accordingly. In this way, the script is believed
to be able to infect new and legacy systems back to Windows Server 2008.
In case the OS version is suitable for the attack, the script alters the boot settings and attempts to encrypt the whole drives using BitLocker. It establishes a new boot partition, essentially setting up a separate section on the computer’s drive containing the files for booting the operating system. This action is aimed at locking the victim out at a later stage. The attackers also delete the protectors used to secure BitLocker’s encryption key so that the victim can’t recover them.
The malicious script then sends information about the system and the encryption key generated on the compromised computer to the server controlled by the threat actor. Afterward, it covers its tracks by deleting logs and various files that serve as a hint and help to investigate an attack.
As a final step, malware forces the shutdown of the system - a capability facilitated by the creation and reinstallation of files in a separate boot partition. The victim sees the BitLocker screen with the message: “There are no more BitLocker recovery options on your PC”.
The message appearing on the victim’s screen after forced system shutdown
Kaspersky dubbed the script "ShrinkLocker" as this name highlights the critical procedure of partition resizing, which was essential for the attacker to ensure the system booted correctly with the encrypted files.
“What is particularly concerning about this case is that BitLocker, originally designed to mitigate the risks of data theft or exposure, has been repurposed by adversaries for malicious ends. It’s a cruel irony that a security measure has been weaponized in this way. For companies using BitLocker, it’s crucial to ensure strong passwords and secure storage of recovery keys. Regular backups, kept offline and tested, are also essential safeguards,” explains Cristian Souza, Incident Response Specialist at Kaspersky Global Emergency Response Team.
The incident’s detailed technical analysis is available on Securelist. Kaspersky experts recommend the following mitigation measures to prevent attackers from exploiting the feature described in the report:
We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.