Executive Summary
ShrinkLocker is a VBS‑driven Windows ransomware that abuses BitLocker's legitimate encryption engine to lock files and rename affected drives to an attacker email address. The malware’s concise script-based delivery allows quick execution and minimal persistence, making it difficult for traditional malware scanners to flag. Victims are compelled to contact the adversary via the embedded email for ransom payment.
Enhanced Description
ShrinkLocker is a Windows‑targeted ransomware that is delivered and executed via a Visual Basic Script (VBS). The script leverages the legitimate BitLocker drive‑encryption feature – normally used for protecting whole volumes at rest – to encrypt specific user files and folders on the victim system. Once encrypted, the malware renames the affected logical drives so that their labels resemble the attacker’s contact email address. This not only obfuscates the state of the system but also serves as a convenient hint for victims to locate the ransom note and contact information. The use of BitLocker provides several advantages to the adversary: it requires no custom cryptographic libraries, is native to the OS and therefore less likely to trigger traditional anti‑virus heuristics, and can be enabled via command‑line shortcuts invoked from the VBS payload. By disguising the ransomware’s impact as a legitimate encryption process, ShrinkLocker also benefits from delayed detection as many security tools focus on more typical ransomware codebases. After the drive labels have been altered, the malware drops a ransom message that instructs victims to pay a specified amount (usually in cryptocurrency) and communicate through the provided email address. This method of contact keeps the threat actors hidden behind an easily reachable channel while allowing rapid negotiation. The script terminates after these steps, leaving no additional persistence layers detectable. Overall, ShrinkLocker exemplifies the hybrid approach attackers are increasingly adopting: combining native OS capabilities with simple scripts to reduce their footprint and evade detection, all while delivering a classic ransom‑based extortion model.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
Confidence is moderate; the information is derived from reputable vendor reports (Kaspersky and Splunk) but lacks depth on persistence, infection vectors, or advanced obfuscation techniques. Further analysis of sample code would close gaps about initial execution pathways and potential lateral movement capabilities.
ShrinkLocker is a VBS-based malicious script that leverages the legitimate Bitlocker application to encrypt files on victim systems for ransom. ShrinkLocker functions by using Bitlocker to encrypt files, then renames impacted drives to the adversary’s contact email address to facilitate communication for the ransom payment.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)