Exploiting Vulnerabilities: A Look at New Ransomware Tactics Targeting Office Printers and BitLocker

Recent investigations in Latin America have uncovered a strikingly concerning trend in ransomware tactics: attackers are leveraging office printers alongside BitLocker encryption to extort organizations. Two notable incidents in Colombia and Mexico exemplify how emerging methods exploit misconfigurations within corporate IT infrastructure. This article dissects these incidents, explores emerging ransom trends, and highlights essential cybersecurity practices that organizations must adopt to mitigate similar threats.

Attack Overview: Ransomware and BitLocker

Both incidents began with users observing a padlock icon by their drives on Windows Explorer, signaling that BitLocker encryption had been activated. This encryption rendered the drives inaccessible without a recovery key. Unfortunately, such attacks are not unprecedented; previous threats like ShrinkLocker also used BitLocker for malicious encryption purposes.

Drive icon indicating that the drive is locked

Case Study 1: RDP Exploitation in Colombia

The first incident took place in Colombia, where attackers exploited an exposed Remote Desktop Protocol (RDP) service. Using this vulnerability, they gained control of a machine associated with an 8 TB storage device that housed sensitive financial data. After taking over the system, they enabled BitLocker encryption specifically on the drive that held critical information. Following the encryption, the attackers issued ransom notes using the company's printers.

Ransomware note

A crucial factor in this breach was the lack of security measures around the RDP service, combined with poorly configured access controls. The organization faced a ransom demand of just $3,000, which they considered paying, but their prompt recovery efforts made it impossible to conduct a thorough investigation.

Attacker’s reply to the victim’s email sent to the address in the printed ransom note

Case Study 2: MSSQL Misconfiguration in Mexico

The second case unfolded in Mexico, where attackers exploited a misconfigured MSSQL service. Their method involved accessing database login credentials due to insecurely stored code on GitHub. This breach paved the way for a three-month long reconnaissance phase in which the attackers confirmed access to the environment.

XEntry team attack

During this stage, they manipulated configurations and installed web shells in public folders, which existing Endpoint Protection Platform (EPP) controls managed to contain but did not entirely neutralize. Despite generating alerts, the company's response was insufficient, allowing the attackers to proceed.

Once deep within the system, they used the misconfiguration of MSSQL Server 2019 to execute arbitrary operating system commands, facilitating greater access to the organization’s internal systems.

A subset of the critical information identified and collected by the attackers

Execution of the Attack

By early May, the attackers had executed scans and began deploying Remote Monitoring and Management (RMM) tools to maintain persistence in the network. Through applications such as ManageEngine’s Endpoint Central and others, they enabled BitLocker on various disks, creating unique keys for each one encrypted. This tactic illustrates a significant shift, as attackers now utilized prevalent Microsoft tools for effective data encryption and ransom demands, rather than relying solely on traditional ransomware.

Attack path

As the attacks escalated, users experienced system lockouts and soon received printed ransom notes from the office printers.

Ransom note printed by the XEntry team

Recommendations and Security Insights

• Both incidents emphasize that, while security measures existed, poor alert management and decisions around application compatibility contributed to vulnerabilities.
• Organizations must strictly adhere to cybersecurity best practices when configuring RDP to prevent unauthorized access. Recent studies reveal that over 13% of incidents stem from policy violations and configuration errors.
• It is crucial to implement rigorous application control policies and monitor network traffic for potential Command-and-Control (C2) communications, given that over 20% of incidents involve the abuse of RMM tools.
• Proper incident response procedures are essential. Organizations should preserve evidence for post-incident analysis and adapt controls to prevent future occurrences of similar attacks.
• Notable phrases in the ransom notes suggest possible connections between the attackers, indicating a need for ongoing threat monitoring.

The findings from these incidents highlight an evolving landscape of ransomware tactics that leverage built-in tools within organizations' infrastructure, showing that standard defenses may no longer suffice. Continuous monitoring and prompt responses are essential to safeguard sensitive data and maintain operational integrity against such threats.

Detection Signatures

• Trojan.Multi.Agent.gen
• Trojan.Win32.GenAutorunMsSqlServerCommandRun.a
• Trojan.Win32.Generic
• Exploit.Win32.SCShell.a

Organizations should remain vigilant and stay updated on best practices, adapting to counter emerging threats in their environments.