Recent investigations in Latin America have uncovered a trend where attackers leverage built-in Windows tools, specifically BitLocker, to encrypt corporate data following the exploitation of misconfigured services. Two primary cases in Colombia and Mexico highlight how internet-exposed RDP services and MSSQL servers with enabled xp_cmdshell provide initial access. In these incidents, attackers notably bypassed traditional endpoint protection by exploiting application incompatibilities or leveraging stolen credentials found on public repositories like GitHub.
Beyond encryption, the "XEntry Team" and similar actors have demonstrated a unique method of communication by hijacking corporate printers to produce physical ransom notes. They often utilize Remote Monitoring and Management (RMM) tools like Mesh Agent and Tactical RMM to maintain persistence and deploy encryption tasks via Group Policy Objects (GPO). The findings underscore the critical need for strict RDP hardening, proactive log management, and robust backup strategies to mitigate the risks posed by these low-cost yet effective "living-off-the-land" ransomware tactics.
Top comments (0)