Loading story…
A newly identified Chinese ransomware strain, DexCrypt MBRLocker (also referred to as DexLocker), was reported replacing victims’ master boot record (MBR) and locking systems before Windows could start. After infection, affected machines reportedly rebooted immediately into a pre-boot ransom screen featuring an ASCII skull and instructions to send 30 Yuan to QQ account 2055965068 to regain access. Microsoft said Windows Defender detects the malware as Ransom:DOS/Dexcrypt.A, and an Any.Run analysis showed the reboot-and-lock behavior occurring directly after execution.
The report said some victims may be able to unlock the system with the password ssssss, while recovery is also possible in cases where only the MBR was overwritten. In those situations, responders can use the Windows Recovery Console to repair the boot record with commands such as:
bootrec /fixmbr
bootrec /fixboot
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Researcher kangxiaopao stated that entering the password "ssssss" may restore access on affected systems. The report also noted that if only the MBR was replaced, recovery may be possible through the Windows Recovery Console using bootrec commands.
Microsoft's Windows Defender Security Team said the malware is detected as Ransom:DOS/Dexcrypt.A, indicating Defender can identify the threat.
An AnyRun video posted by JAMESWT showed DexLocker immediately rebooting an infected computer after installation and displaying a pre-boot lock screen with an ASCII skull. The ransom note demanded 30 Yuan be sent to QQ account 2055965068.
Security researcher JAMESWT first discovered the Chinese MBRLocker ransomware family DexLocker, which overwrites the master boot record and locks systems before Windows starts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **ShrinkLocker** is a ransomware strain that turns Microsoft **BitLocker** against victims by modifying disk layouts, boot settings, and recovery mechanisms instead of relying only on conventional file encryption. Splunk said the malware checks the operating system, changes registry settings related to **RDP** and **TPM**, disables BitLocker key protectors, shrinks non-boot partitions, formats them, and rewrites boot configuration in ways that can leave affected machines difficult or impossible to recover. The malware was also observed exfiltrating data to command-and-control infrastructure and attempting to erase evidence by deleting logs, firewall rules, and scheduled tasks. Public reporting tied the activity to malware components including `disk.vbs_`, `Dim oShell.txt`, and `run.vbs`, highlighting a script-driven intrusion chain built around native Windows functionality. Bitdefender later published a **ShrinkLocker decryptor**, framing the threat as a case in which a legitimate Microsoft disk-encryption feature was repurposed for ransomware and then countered with a recovery tool. The combined reporting underscores that ShrinkLocker can both deny access to systems and complicate restoration by corrupting partitions and boot paths while using BitLocker as the locking mechanism.
Jun 29, 2026
Researchers analyzed multiple **COVID-themed Windows malware** samples, including **CoViper** and **Covid22**, that use pandemic-related lures before deploying destructive components that overwrite the **Master Boot Record (MBR)** and leave systems unable to boot. In the CoViper case, a PureBasic installer drops several files, creates a hidden `%HOMEDRIVE%\COVID-19` folder, establishes persistence, disables Task Manager and some UAC protections, changes the wallpaper and cursor, and repeatedly displays a nuisance GUI. Its `end.exe` payload reads `\\.\PhysicalDrive0`, replaces the MBR with attacker code, and shows a taunting message on reboot, with language-specific text for German systems. Fortinet reported a related sample, **Covid22**, posing as a fake installer and dropping `WipeMBR.exe`, which overwrites the first 512 bytes of the MBR without encrypting or stealing files, making the malware destructive but not ransomware. Analysts noted CoViper also backs up the original MBR and contains a hidden recovery shortcut using **CTRL+ALT+ESC**, suggesting unfinished development or experimentation. Defenders were provided hashes, YARA rules, and recovery guidance, including Windows repair options and the command: ```cmd bootrec.exe /fixmbr ```
Aug 15, 2026
**WhiteLock** ransomware has been identified targeting Windows systems, encrypting files and appending the `.Fbin` extension before dropping a ransom note named `c0ntact.Txt` and changing the victim’s wallpaper to increase pressure to pay. During execution, the malware contacts an external server, derives a victim identifier by hashing the device’s MAC address, retrieves an RSA public key, and encrypts files with **AES-CBC** while protecting the AES key with **RSA-2048**. The operation also attempts to hinder containment by checking for **AnyDesk** and **TeamViewer** and terminating their services while encryption is underway. The ransom note claims both file encryption and data theft, threatens to publish or sell stolen data if payment is not made, and directs victims to a Tor-based negotiation page. Reporting also links WhiteLock activity to campaigns where information-stealing malware was used for initial access before ransomware deployment, underscoring the need to monitor abnormal outbound connections, remote access tool activity, mass file changes, ransom note creation, and service termination behavior.
Jul 8, 2026