Ankura CTIX FLASH Update - May 29, 2024

Ransomware/Malware Activity

New ShrinkLocker Ransomware uses BitLocker for Encryption

Researchers at Kaspersky Labs have discovered a new ransomware strain dubbed "ShrinkLocker" which uses Windows BitLocker to encrypt victim machines. The ransomware achieves this by creating a new boot partition through shrinking available non-boot partitions. ShrinkLocker is written in VBScript and runs a series of checks against the victim machine that it must pass before the ransomware continues with the attack. ShrinkLocker has targeted government entities and companies in the vaccine and manufacturing sectors. Unlike traditional ransomware, ShrinkLocker maximizes damage by detecting specific Windows versions and parameters before proceeding with encryption. It modifies registry entries to disable remote desktop connections and enables BitLocker on systems without a Trusted Platform Module (TPM). The malware uses the diskpart utility to shrink partitions, creates new primary