XEntry Team

XEntry Team is a threat actor associated with a BitLocker-based extortion intrusion in Mexico. The group abused misconfigured, internet-exposed Microsoft infrastructure rather than deploying bespoke ransomware, using native Windows and Microsoft SQL Server functionality together with remote monitoring and management tools to gain control of systems, propagate across the environment, and encrypt endpoints. In the observed intrusion, initial access was obtained through an exposed and misconfigured Microsoft SQL Server instance using compromised credentials. The attackers then used SQL Server command-execution functionality to run operating system commands, attempted to weaken web-server protections, searched internal systems and shared resources for critical data, and expanded access inside the victim network. XEntry Team established persistence and operational control through multiple RMM tools, including ManageEngine Endpoint Central, Mesh Agent, and Tactical RMM. The actor used scheduled tasks and later Group Policy Object deployment to activate BitLocker at scale, generate recovery keys on encrypted systems, and spread actions across domain-synchronized hosts. Victims became aware of the attack when systems displayed a message attributing the compromise to XEntry Team and user credentials no longer worked; ransom demands were subsequently printed on corporate printers. The tradecraft reflects hands-on-keyboard post-compromise activity, abuse of legitimate administrative tooling, and reliance on built-in platform capabilities for encryption and impact rather than custom malware. Based on the observed operation, the actor demonstrates capabilities in initial access, persistence, reconnaissance, lateral movement, defense evasion, and extortion-oriented post-exploitation.