ShrinkLocker

Description

ShrinkLocker is ransomware written in VBScript that encrypts files and uses BitLocker, the disk encryption feature built into Windows, to lock infected systems. Rather than bringing its own cryptography, it repurposes enterprise encryption management, which makes the attack look like legitimate administrative activity while systems become inaccessible. The approach reflects a broader trend of ransomware abusing native security tools, and defenders should monitor BitLocker changes closely.

Stats

First seen

May 2024

Last seen

October 2026

MITRE ATT&CK techniques

21 techniques across 7 tactics.

Alert name variants

Related families

References

• malpedia.caad.fkie.fraunhofer.de →
• attack.mitre.org →