Kaspersky: Attackers Abuse BitLocker as a White-Hat Weapon in Hybrid Ransomware Against Colombian and Mexican Enterprises

Kaspersky GReAT, 2 Aug 2026: two intrusions in Colombia and Mexico used no third-party cryptor. Operators invoked native Windows BitLocker to lock critical data. Initial access was internet-exposed RDP and SQL Server credentials leaked on GitHub. LOLBins / Living-off-the-Land is now a hybrid ransomware pattern.

Incident Overview

On 2 Aug 2026, Kaspersky GReAT published two remote intrusion and lockout incidents in Colombia and Mexico. Attackers used no third-party crypto-ransomware. They invoked native Windows BitLocker to lock financial files, servers, and other critical assets, then printed ransom notes on internal printers.

Unlike traditional crypto-malware, operators relied only on built-in Windows components. EDR, firewalls, and endpoint detection rules face a new problem: a legitimate process calling a legitimate API is indistinguishable from a normal admin.

Technical Details

Colombia case:

• Initial access: a Windows server exposed RDP to the internet (`0x3389` unrestricted source IP). Attackers used cracking tools to obtain local admin, then changed account credentials.

• Encryption: BitLocker enabled only on the logical volume holding financial data on 8TB storage—not full-disk—so the OS stayed up.

• Ransom note: printed «recovery fee and ransom notice» on office-floor printers to apply psychological pressure.

• Victim response: paid USD 3,000 (~CNY 20,306) before forensics to restore finance ops. Intrusion trail and evidence became hard to reconstruct.

Mexico case:

• Initial access: a developer committed plaintext SQL Server username and password to a public GitHub repo. Attackers found them via GitHub search and authenticated.

• Privilege / lateral: legitimate remote-admin tools similar to `cobalt strike`, `anydesk`, Atera; multiple admin sessions on the server; then GPO and scheduled tasks to enable BitLocker in bulk on internal hosts.

• Stealth: no third-party payload at any point. Native BitLocker plus legitimate RMM. EDR and firewalls cannot key off classic malware signatures.

Neither incident used traditional crypto-malware (cryptor/trojan-ransom). Kaspersky warns next-gen ransomware will prioritize LOLBins, LOLDrivers, native tools, and OS APIs. Treat the native-locker path as high risk.

Impact Assessment

• New attack trend: BitLocker is a legitimate Windows data-protection feature. After perimeter breach and credential takeover it becomes a “white-hat locker” with zero malware. Same direction as the LotL/LOLBins rise.

• Evidence destruction: ransom paid without preserved evidence or isolation of compromised hosts. Lost the golden window to track, investigate, and attribute.

• Broader enterprise risk: in China, SMEs, workshops, hospitals, universities, and medical facilities still widely run on-prem servers—often with internet RDP and shared cross-department accounts. Once breached, same native-locker exposure.

Remediation

• Priority: audit internet-exposed RDP and SQL Server. At the perimeter and cloud proxies, restrict RDP to VPN/SSO only; enforce NLA. Close public 1433/1434. Force SQL Server password policy and rotating credentials.

• Full secret scan of code stores: GitHub, Gitee, Coding, internal Git. Hunt emails, certs, keys, admin URLs. Scan with `trufflehog`, `git-secrets`, `detect-secrets`.

• Disable unneeded BitLocker auto-unlock. Enable only on volumes that require encryption. Central hosts: TPM+PIN. Do not store recovery keys in plaintext.

• Remote-access credentials and logging: MFA on RDP/SSH at the perimeter. Log all account, GPO, and scheduled-task changes on servers; ship to a separate log platform.

• Freeze evidence before recovery: on any encryption incident, capture memory image, event logs, and packets first. Do not let ransom payment cause irreversible damage to the investigation.

References

• Kaspersky official release (2026-08-02)

• IT Home reprint: detailed report on attackers encrypting enterprises with BitLocker

• Sohu: BitLocker used as an encryption weapon

• Living-off-the-Land (LOLBins) background