Kaspersky ShrinkLocker 2024

ShrinkLocker captures the IP address of the victim system and sends this to the attacker following encryption.

ShrinkLocker will exfiltrate victim system information along with the encryption key via an HTTP POST.

ShrinkLocker uses WMI to query information about the victim operating system.

ShrinkLocker uses PowerShell to disable protectors used to secure the BitLocker encryption key on victim machines and then delete the key from the system.

ShrinkLocker is a VisualBasic script (VBS) object that calls multiple other operating system functions during execution.

ShrinkLocker can delete itself depending on various checks performed during execution.

ShrinkLocker uses HTTP POST requests to communicate victim information back to the threat actor.

ShrinkLocker uses WMI queries to gather various information about the victim machine and operating system.

ShrinkLocker uses a subdomain on the legitimate Cloudflare resource "trycloudflare[.]com" to obfuscate the threat actor's actual address and to tunnel information sent from victim systems.

ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.

ShrinkLocker uses the legitimate BitLocker application to encrypt victim files for ransom.

ShrinkLocker renames disk labels on victim hosts to the threat actor's email address to enable the victim to contact the threat actor for ransom negotiation.

ShrinkLocker can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.

ShrinkLocker disables protectors used to secure the BitLocker encryption key on victim systems.

ShrinkLocker calls Wevtutil to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.

ShrinkLocker turns on the system firewall and deletes all of its rules during execution.