Recent investigations in Latin America have uncovered a series of cyberattacks leveraging legitimate system tools, specifically Microsoft BitLocker, to encrypt corporate data for ransom. These incidents, occurring in Colombia and Mexico, involved attackers exploiting misconfigured RDP services and MSSQL servers. In both cases, the attackers bypassed traditional ransomware payloads by utilizing built-in Windows features and RMM tools to maintain persistence and execute the encryption.
Notably, the attackers utilized physical office printers to deliver ransom notes, notifying victims that their infrastructure was compromised. In one instance, the 'XEntry Team' gained access via credentials leaked on GitHub and manipulated the SQL server's xp_cmdshell procedure. These attacks underscore the growing trend of 'living off the land' techniques where built-in utilities and remote management software are repurposed for malicious activities, making detection more challenging for traditional security platforms.
Top comments (0)