We have already reported that ransomware actors are increasingly using BitLocker, which is legally pre-installed on their victims’ computers - so attackers don’t even need to create and upload their own encryption software. A new investigation by our experts in Latin America shows how exactly the attackers take control of this tool.
One of the incidents occurred in Colombia. The attackers exploited an internet-exposed RDP service with additional open ports on a machine connected to a storage device containing critical data. After breaching the system, the actors identified an additional drive, leveraged BitLocker to encrypt the data, and used the company’s printers to produce ransom notes.
In another incident, in Mexico, the attackers gained initial access to the infrastructure through a misconfigured Microsoft SQL Server. First, they obtained the database login credentials from code insecurely published on GitHub. The misconfiguration of the MSSQL server allowed them to execute operating system commands via the xp_cmdshell procedure. As a result, it became possible to execute arbitrary commands directed at the server and the local infrastructure.
Resume: It’s hard to capture BitLocker-based encryption process since it’s a legitimate Windows tool and its activity is not blocked by antivirus software. However, in both cases, there were simple ways to eliminate the possibility of initial access for the attackers.
In the first incident, it’s about restricting public access to RDP.
In the second - controlling data published on GitHub, and secure configuration of the MSSQL server.
Details of the investigation of these incidents can be found in the article by Eduardo Ovalle “A new extortion cocktail: office printers, small ransoms, and BitLocker”.
