Ankura CTIX FLASH Update - November 15, 2024

Malware Activity

Bitdefender Releases Decryptor for ShrinkLocker Ransomware

Bitdefender has delighted ShrinkLocker Ransomware victims by releasing a decryptor for the ransomware variant this week. ShrinkLocker ransomware leverages Windows' built-in BitLocker drive encryption instead of custom encryption implementations commonly used by ransomware. In a ShrinkLocker attack, the ransomware first checks whether BitLocker is enabled on the victim machine and installs BitLocker if not already present. The ransomware generates a random password for the BitLocker encryption using network traffic and memory usage data. Importantly, the ransomware also deletes or reconfigures all BitLocker protectors to hinder recovery of the encryption keys. While lacking the sophistication of most ransomware strains, ShrinkLocker has successfully attacked corporate systems and has targeted organizations in the government, healthcare, and manufacturing sectors in Mexico, Indonesia and