A new extortion cocktail: office printers, small ransoms, and BitLocker
Two separate incidents – one in Colombia and another in Mexico – highlight a concerning trend of attackers leveraging misconfigured systems and built-in Microsoft tools to deploy BitLocker encryption and demand ransom payments. Attackers gained initial access through vulnerabilities like internet-exposed RDP services and insecure MSSQL databases, then used tools like ManageEngine’s Endpoint Central RMM to encrypt systems and deliver ransom notes via corporate printers. The incidents underscore a strategy of avoiding ransomware partnerships, instead utilizing existing infrastructure to achieve their goals, and a critical lack of proactive monitoring and incident response.
Recently, our teams in Latin America investigated a series of incidents involving misconfiguration, the deployment of BitLocker, and the exploitation of corporate printers to deliver ransom notes. This article analyzes two incidents that occurred in June in Colombia and in May in Mexico, revealing similarities in the attackers’ communications and emerging trends in ransom amounts.
In both cases, the affected users initially noticed a padlock icon next to their drives in Windows Explorer, indicating that the drive was encrypted with BitLocker, blocking access to its contents. A recovery key was required to unlock the drive. These cases confirm that adversary’s objective is to gain access to infrastructure while avoiding investment in or partnership with ransomware groups. Instead, they leverage existing infrastructure to achieve their goals.
In Colombia, attackers exploited an internet-exposed RDP service on a machine connected to an 8 TB storage device containing mission-critical data. After taking control of the system and manipulating user credentials, they enabled BitLocker exclusively on the drive that primarily stored financial data. Once the encryption was complete, they locked the drive and used the company’s printers to produce ransom notes. The company considered paying the ransom, but the system was restored before forensic analysis could be completed, eliminating crucial evidence.
In Mexico, the attack began three months prior to detection. The attackers exploited a misconfigured MSSQL service, gaining access to the database login credentials from code insecurely published on GitHub. They then manipulated the web server configuration, creating web shell files in publicly accessible folders. Despite alerts, the necessary investigation to address the activity was not conducted. The attackers subsequently confirmed their ability to execute commands locally and set up their attack infrastructure to transmit data via a communications bridge.
Microsoft SQL Server 2019.0150.2160.04 was misconfigured to allow operating system command execution via the xp_cmdshell extended stored procedure. This allowed the attackers to establish a channel capable of executing any type of command directed at the server and the local infrastructure within its scope. The attackers focused on identifying shared systems and resources that provided access to critical information, including networking, enterprise management, and cloud services.
In early May, the attackers focused on running additional scans and deploying ManageEngine’s Endpoint Central RMM to establish persistence and begin the final stages of their intrusion. Further RMM-type applications, such as Mesh Agent and Tactical RMM, were installed to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system. Finally, in mid-May, the attackers managed to execute a Group Policy Object (GPO) used to deploy activation and encryption tasks, as well as other policies responsible for continued deployment of RMM applications via scheduled tasks. The activity initially targeted critical systems but later spread to every system synchronized with the domain controller. Users became aware of the attack when their machines displayed a blue screen with the message “Hacked by XEntry Team”, and their credentials stopped working to access their systems. A few hours later, ransom notes began emerging from office printers.
Our teams continue to monitor these threats. Detection signatures include Trojan.Multi.Agent.gen, Trojan.Win32.GenAutorunMsSqlServerCommandRun.a, and Trojan.Win32.Generic.