Hackers use the ShrinkLocker ransomware to corrupt your BitLocker

ShrinkLocker is the name of the new ransomware that’s affecting Microsoft’s BitLocker. Like most ransomware, it encrypts corporate files, steals decryption keys, and asks you to pay a ransom to retrieve them. So, BitLocker isn’t safe on modern devices.

Global Emergency Response, the maker of the Kaspersky antivirus, discovered and named it. According to them, the ransomware targets steel and vaccine manufacturing companies and governmental institutions from Mexico, Indonesia, and Jordan.

How did the hackers develop the ShrinkLocker ransomware?

Cybercriminals created the ShrinkLocker ransomware using Visual Basic Scripting (VBScript), a deprecated programming language for automated tasks and controlling applications on Windows-based systems. The ShrinkLocker script can verify the current version of your Windows. According to Kaspersky, it can attack new and old systems dating back to Windows 2008.

The ShrinkLocker ransomware will delete itself if your device doesn’t meet the requirements of the wrongdoer. For example, if your domain doesn’t match the target or your device is older than Vista, it won’t affect you.

If your device is suitable for the attack, ShrinkLocker will change your boot settings. Then, it will use BitLocker to attempt to encrypt your partitions. Besides that, it will use the diskpart command to shrink your non-Windows partitions. Afterward, it creates primary volumes using the unallocated space left and reinstalls the boot files on the new partitions.

The ransomware locks you out

ShrinkLocker can lock you out of your device because it removes the security systems of your BitLocker encryption key to prevent you from recovering it. The ransomware removes the key from your device after sending it to the hackers.

When the malware finishes its process, it shuts down your device and leaves you with all drivers locked and without a way to recover what’s lost. Also, it deletes the files and logs that could lead to details about the attack. On top of that, if you attempt to open your device, it shows the following message: There are no more BitLocker recovery options on your PC.

Ultimately, to protect your device and organization from the ShrinkLocker ransomware, you can use an Endpoint Protection Platform (EPP) solution. It will help you find out if anyone tried to tinker with your BitLocker, limit users, and track events related to VBS and PowerShell.

Did you ever encounter a BitLocker malware? Let us know in the comments.