Loading malware…
ShrinkLocker is a Windows ransomware strain that abuses Microsoft BitLocker and native system utilities to deny access to victim systems rather than relying solely on a conventional custom file-encryption routine. It has been described as a VBScript-based threat that validates aspects of the target environment before proceeding, then manipulates disk layout, boot configuration, and BitLocker policy settings to maximize disruption and complicate recovery. Observed behavior includes shrinking non-boot partitions, creating new boot volumes, reinstalling or reconfiguring boot files, enabling BitLocker even on systems without TPM support, and deleting BitLocker protectors so victims are left without normal recovery options. Some reporting also notes that these partition and boot changes can destabilize systems and may cause data corruption or render hosts difficult to recover.
ShrinkLocker modifies Windows registry settings associated with BitLocker configuration and has also been observed changing settings related to Remote Desktop. It uses legitimate Windows components such as disk management tooling, BCDEdit, WMI, and BitLocker administration commands as part of a living-off-the-land approach. After encryption activity, it can forcibly shut down the system, and it may restart the host if execution errors occur. Defense-evasion behavior attributed to the malware includes deleting logs, scheduled tasks, and firewall rules.
Unlike many ransomware families, ShrinkLocker has been reported to avoid a traditional ransom note on disk. Instead, it can rename disk labels to embed attacker contact information for ransom negotiation. It also exfiltrates victim system information and the generated BitLocker key to attacker-controlled infrastructure, including use of Cloudflare Tunnel services to obscure the receiving endpoint.
Victimology reported for ShrinkLocker includes a government entity and organizations in the vaccine, steel, and manufacturing sectors, with observed targeting in Mexico, Indonesia, and Jordan. The malware is associated with corporate Windows environments and stands out for combining extortion with strongly destructive characteristics, leading some researchers to assess that certain deployments may be intended to cause operational damage as much as to obtain payment.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses WMI to query information about the victim operating system.(Citation: Kaspersky ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses PowerShell to disable protectors used to secure the BitLocker encryption key on victim machines and then delete the key from the system.(Citation: Kaspersky ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) is a VisualBasic script (VBS) object that calls multiple other operating system functions during execution.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
and attempts to erase traces of its activity by deleting logs, firewall rules, and scheduled tasks.
[ShrinkLocker](https://attack.mitre.org/software/S1178) can delete itself depending on various checks performed during execution.(Citation: Kaspersky ShrinkLocker 2024)
ShrinkLocker is a new ransomware that uses Windows BitLocker to encrypt files by creating new boot partitions.
[ShrinkLocker](https://attack.mitre.org/software/S1178) will exit its "main" function if the victim domain name does not match provided criteria.(Citation: Splunk ShrinkLocker 2024)
The malware initiates its attack by identifying the operating system and determining whether it’s a suitable target.
[ShrinkLocker](https://attack.mitre.org/software/S1178) modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) disables protectors used to secure the BitLocker encryption key on victim systems.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) calls [Wevtutil](https://attack.mitre.org/software/S0645) to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.(Citation: Kaspersky ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) turns on the system firewall and deletes all of its rules during execution.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) captures the IP address of the victim system and sends this to the attacker following encryption.(Citation: Kaspersky ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) checks whether the Bitlocker Drive Encryption Tools service is running.(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses WMI queries to gather various information about the victim machine and operating system.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) retrieves a system timestamp that is used in generating an encryption key.(Citation: Splunk ShrinkLocker 2024)
The malware initiates its attack by identifying the operating system and determining whether it’s a suitable target.
It modifies key system registry settings, particularly those related to Remote Desktop Protocol (RDP) and Trusted Platform Module (TPM), to suit its objectives.
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses HTTP POST requests to communicate victim information back to the threat actor.(Citation: Kaspersky ShrinkLocker 2024)
“ngrok has been used… to proxy C2 connections to ngrok service subdomains… ShrinkLocker uses… trycloudflare[.]com to… tunnel information… BADHATCH… abuse sslip.io… as part of actor-controlled C2 channels… FIN8 has used sslip.io… as part of their command and control.”
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses a subdomain on the legitimate Cloudflare resource "trycloudflare[.]com" to obfuscate the threat actor's actual address and to tunnel information sent from victim systems.(Citation: Kaspersky ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) will exfiltrate victim system information along with the encryption key via an HTTP POST.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
The key is delivered through the TryCloudflare tool, a legitimate service for developers to experiment with CloudFlare's Tunnel without adding a site to CloudFlare's DNS.
[ShrinkLocker](https://attack.mitre.org/software/S1178) can initiate a destructive payload depending on the operating system check through resizing and reformatting portions of the victim machine's disk, leading to system instability and potential data corruption.(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) uses the legitimate BitLocker application to encrypt victim files for ransom.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
MultiLayer Wiper 'removes the Volume Shadow Copy (VSS) service from infected devices along with all present shadow copies'; ShrinkLocker 'disables protectors used to secure the BitLocker encryption key on victim systems.'
[ShrinkLocker](https://attack.mitre.org/software/S1178) renames disk labels on victim hosts to the threat actor's email address to enable the victim to contact the threat actor for ransom negotiation.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
[ShrinkLocker](https://attack.mitre.org/software/S1178) can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.(Citation: Kaspersky ShrinkLocker 2024)
It targets non-boot partitions, shrinks them, and creates new boot volumes.
After disabling BitLocker key protectors, ShrinkLocker shrinks non-boot partitions by 100MB, formats these partitions, and reconfigures boot files to destabilize the system, potentially rendering it irreparable.
[ShrinkLocker](https://attack.mitre.org/software/S1178) has used [Diskpart](https://attack.mitre.org/software/S9002) to format newly-created partitions.(Citation: Splunk ShrinkLocker 2024)
BlackByte Ransomware modifies the victim Registry to prevent system recovery; ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.