Attackers Combine Printer Exploits and BitLocker for Low-Ransom Extortion Scheme
A novel extortion tactic sees threat actors leveraging misconfigured printers and BitLocker encryption to demand small ransoms from organizations, targeting victims in Latin America.
Security researchers have identified a new and concerning extortion scheme where threat actors are exploiting misconfigured corporate printers and Microsoft's BitLocker encryption to demand ransom payments. The tactic was observed in two distinct incidents in Latin America during May and June, highlighting a trend towards smaller, more targeted attacks with lower ransom demands.
In both cases, the initial sign of compromise for affected users was the appearance of a padlock icon next to their drives in Windows Explorer, indicating that the data had been encrypted using BitLocker. This effectively blocked access to critical files, requiring a recovery key to regain entry. This method echoes previous attacks, such as the ShrinkLocker threat discovered years ago, which also utilized BitLocker for malicious purposes.
The first incident, occurring in Colombia in June, involved attackers exploiting an internet-exposed Remote Desktop Protocol (RDP) service. After gaining access and manipulating credentials, they selectively encrypted a drive containing mission-critical financial data with BitLocker. Once encryption was complete, the attackers used the company's own printers to distribute ransom notes, demanding a relatively low sum of $3,000. The company, facing significant disruption, considered paying the ransom, but unfortunately, the system was restored before forensic analysis could be completed, leaving limited evidence.
This attack vector was facilitated by an improperly secured, internet-facing RDP service, which employees used for remote access. The lack of robust security controls on these exposed ports created a critical vulnerability. Compounding the issue, the Endpoint Protection Platform (EPP) was disabled on the affected system due to compatibility concerns, allowing attackers to operate with reduced detection.
The second incident, which took place in Mexico in May, revealed a different initial access method: a misconfigured Microsoft SQL Server (MSSQL) service. Attackers obtained database login credentials from code that was insecurely published online, enabling them to execute commands on the system. This breach began months before detection, with the threat actor meticulously exploring the environment and lowering security settings on the web server.
Despite some alerts from existing security controls, the necessary investigations were not conducted. The attackers then leveraged the MSSQL service's xp_cmdshell extended stored procedure, a misconfiguration that allowed them to execute arbitrary operating system commands. This gave them broad access to internal systems, including those storing sensitive configuration parameters for networking, enterprise management, and cloud services.
In the final stages of the Mexican incident, the attackers deployed ManageEngine's Endpoint Central Remote Monitoring and Management (RMM) tool, along with other RMM applications like Mesh Agent and Tactical RMM. These tools were used to establish persistence and schedule tasks that enabled BitLocker, encrypting individual disks and collecting the recovery keys. The attackers also managed to execute a Group Policy Object (GPO) to further control the environment.
These incidents underscore a growing trend of attackers opting for lower ransom demands and utilizing readily available tools like BitLocker, combined with creative methods like printer-based ransom notes, to maximize impact and pressure victims. The exploitation of exposed RDP and MSSQL services, coupled with disabled security software, highlights the persistent risks posed by basic misconfigurations and inadequate security hygiene.