ShrinkLocker Abuses BitLocker to Lock Systems and Damage Recovery Paths

Researchers reported that ShrinkLocker is a ransomware strain that turns Microsoft BitLocker against victims by modifying disk layouts, boot settings, and recovery mechanisms instead of relying only on conventional file encryption. Splunk said the malware checks the operating system, changes registry settings related to RDP and TPM, disables BitLocker key protectors, shrinks non-boot partitions, formats them, and rewrites boot configuration in ways that can leave affected machines difficult or impossible to recover. The malware was also observed exfiltrating data to command-and-control infrastructure and attempting to erase evidence by deleting logs, firewall rules, and scheduled tasks.

Public reporting tied the activity to malware components including disk.vbs_, Dim oShell.txt, and run.vbs, highlighting a script-driven intrusion chain built around native Windows functionality. Bitdefender later published a ShrinkLocker decryptor, framing the threat as a case in which a legitimate Microsoft disk-encryption feature was repurposed for ransomware and then countered with a recovery tool. The combined reporting underscores that ShrinkLocker can both deny access to systems and complicate restoration by corrupting partitions and boot paths while using BitLocker as the locking mechanism.