12 minhigh
A new extortion cocktail: office printers, small ransoms, and BitLocker
A series of extortion incidents in Latin America leveraged misconfigured internet-exposed services (RDP and MSSQL with xp_cmdshell) to gain initial access, then abused built-in Windows BitLocker to encrypt drives and demand small ransoms. The threat actor 'XEntry Team' deployed multiple legitimate RMM tools for persistence and lateral movement, used GPO to mass-deploy BitLocker encryption across domain-joined systems, and delivered ransom notes through corporate printers. The attacks succeeded due to disabled EPP, ignored security alerts, and inadequate incident response procedures.
Sens:▲ 24h
Showing defanged values
- domaincdnmsftupdates[.]blob[.]core[.]windows[.]netAttacker-controlled Azure Blob Storage domain masquerading as Microsoft update CDN, used to host and distribute malicious RMM agent binary
- emailrecovery[.]datamanager[@]gmail[.]comRansom contact email address printed in ransom notes in the Colombia incident for victim communication with attackers
- emaily_support[@]proton[.]meRansom contact email address used by XEntry Team in the Mexico incident, likely truncated from [email protected]
- filenameDefaultRemoteOffice_Agent.exeMalicious RMM agent binary downloaded from attacker-controlled Azure Blob Storage to establish remote access persistence
- filenametr3sh.phpWeb shell created by attackers in XAMPP htdocs directory on compromised MSSQL server to execute arbitrary PHP commands
- urlhxxps://cdnmsftupdates[.]blob[.]core[.]windows[.]net/cdn/DefaultRemoteOffice_Agent[.]exeMalicious RMM agent executable downloaded via certutil and PowerShell WebClient, hosted on attacker-controlled Azure Blob Storage impersonating Microsoft update infrastructure
Detection / Hunteropenrouter
What Happened
Cybercriminals hacked into companies in Colombia and Mexico by exploiting poorly configured remote access services and database systems. Instead of using traditional ransomware, they used a built-in Windows feature called BitLocker to lock up the companies' data and demanded relatively small payments (around $3,000) to unlock it. They also hijacked office printers to print out their ransom demands. The attackers installed several remote management tools to maintain access and eventually used the company's own network management system to lock every computer at once. These incidents show that even basic security misconfigurations can lead to major disruptions. Organizations should secure remote access services, keep security software running, and respond promptly to security alerts.
Key Takeaways
- Attackers abuse built-in Windows BitLocker to encrypt drives and extort small ransoms ($3,000), avoiding investment in ransomware-as-a-service
- Two incidents in Latin America (Colombia and Mexico) exploited internet-exposed RDP and misconfigured MSSQL (xp_cmdshell) as initial access vectors
- Threat actor 'XEntry Team' deployed multiple RMM tools (ManageEngine Endpoint Central, Mesh Agent, Tactical RMM) for persistence and lateral movement
- Attackers used GPO to deploy BitLocker encryption across all domain-joined systems and printed ransom notes via corporate printers
- EPP was disabled in one case due to application compatibility issues, and alerts were ignored in the other, allowing attackers to operate undetected for months
Affected Systems
- Windows systems with BitLocker capability
- Microsoft SQL Server 2019.0150.2160.04 with xp_cmdshell enabled
- Internet-exposed RDP services
- Corporate printers used for ransom note delivery
- Domain-joined Windows endpoints receiving GPO policies
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers exploited internet-exposed RDP (Colombia case) or misconfigured MSSQL with xp_cmdshell enabled and credentials leaked on GitHub (Mexico case)
- Execution: Attackers executed OS commands via MSSQL, created web shells in XAMPP htdocs directory, and manipulated web server security settings
- Credential Access: Attackers read configuration files from network shares containing Fortigate, SAP, AWS S3, and Grandstream gateway credentials
- Persistence: Multiple RMM tools deployed including ManageEngine Endpoint Central, Mesh Agent, and Tactical RMM via scheduled tasks
- Lateral Movement: Attackers scanned internal network, accessed shared resources, and deployed RMM agents to additional systems via SMB admin shares
- Impact: GPO used to mass-deploy BitLocker encryption across all domain-joined systems; ransom notes printed via corporate printers with contact emails for payment
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Kaspersky detection signatures
The article lists four Kaspersky detection signature names (Trojan.Multi.Agent.gen, Trojan.Win32.GenAutorunMsSqlServerCommandRun.a, Trojan.Win32.Generic, Exploit.Win32.SCShell.a) but does not provide YARA, Sigma, Snort, Suricata, or SIEM query content.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would capture process execution, RMM tool installation, and GPO-deployed scheduled tasks. However, EPP was disabled in one case, and alerts were ignored in the other, reducing effective detection. Built-in tools like manage-bde and certutil may blend with legitimate admin activity. |
| Network Visibility | Medium | Network telemetry would show SMB admin share access, web shell creation over network paths, and downloads from attacker-controlled Azure Blob Storage. However, RMM tool C2 traffic may resemble legitimate remote management activity, making it harder to distinguish without baselining. |
| Detection Difficulty | Hard | Attackers used legitimate built-in Windows tools (BitLocker, GPO, manage-bde) and well-known RMM software, making behavioral detection challenging. The combination of disabled EPP, ignored alerts, and months-long dwell time indicates significant detection gaps. Distinguishing malicious RMM deployment from legitimate admin use requires strong baselining and correlation. |
Required Log Sources
- Windows Security Event Log (4688 process creation, 4624 logon events, 5140/5145 SMB share access)
- Windows System Event Log (BitLocker events)
- PowerShell Script Block Logging (Event ID 4104)
- MSSQL Server error logs and xp_cmdshell execution logs
- Group Policy Object change logs (Event ID 5136)
- Scheduled Task creation logs (Event ID 4698)
- Web server access logs for web shell activity
- DNS resolution logs for internal network discovery queries
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for manage-bde.exe being executed outside of normal IT admin contexts, especially when followed by recovery password extraction commands, as this may indicate attackers collecting BitLocker keys before mass encryption. | Process creation events with command line logging for manage-bde.exe, particularly '-protectors -get' and '-Type recoverypassword' arguments | Impact | Medium - Legitimate IT administrators may run manage-bde commands during routine BitLocker management tasks |
| Consider hunting for multiple RMM tools (Mesh Agent, Tactical RMM, ManageEngine Endpoint Central) installed on the same system within a short timeframe, as this pattern is unusual for legitimate administration and may indicate attacker persistence staging. | Process creation events, file creation in Program Files and Windows Temp, and service installation events for known RMM tool binaries | Persistence | Medium - Some organizations legitimately use multiple RMM tools, though rapid sequential installation is uncommon |
| Consider hunting for GPO modifications that deploy scheduled tasks enabling BitLocker or installing RMM software, as this represents an unusual abuse of domain-level policy for mass encryption deployment. | Group Policy change events (Event ID 5136), scheduled task creation events (Event ID 4698), and BitLocker feature enablement events across multiple systems simultaneously | Lateral Movement | Low - GPO-deployed BitLocker enablement is uncommon and typically only performed by dedicated IT security teams during controlled rollouts |
| Consider hunting for certutil.exe being used with -urlcache -split -f arguments to download executables, as this is a known living-off-the-land technique for downloading malware while bypassing application whitelisting. | Process creation events for certutil.exe with command line arguments containing -urlcache or -split flags | Persistence | Low - certutil is rarely used for legitimate file downloads in enterprise environments |
| Consider hunting for web shell files being created in web server document root directories (e.g., XAMPP htdocs) via SMB admin shares from remote systems, as this indicates lateral movement and web shell deployment via network paths. | File creation events on web server directories, SMB share access logs (Event ID 5145), and process creation for mkdir/echo commands targeting remote admin shares | Execution | Low - Web content creation via SMB admin shares from non-web-admin systems is highly suspicious |
Control Gaps
- EPP disabled due to application compatibility issues, removing endpoint detection and prevention capabilities
- Security alerts generated by EPP were not investigated, allowing attackers to operate undetected for months
- Internet-exposed RDP without adequate security controls (MFA, network-level authentication, access restrictions)
- MSSQL xp_cmdshell enabled on internet-facing server, allowing OS command execution from database context
- Credentials insecurely published on GitHub provided attackers with database login access
- Lack of monitoring for legitimate RMM tool deployment outside of approved IT processes
- No detection for GPO-based mass deployment of encryption or scheduled tasks across domain systems
Key Behavioral Indicators
- manage-bde.exe executed with '-protectors -get' or '-Type recoverypassword' arguments outside of IT admin contexts
- Multiple RMM tool binaries (meshagent.exe, Tactical RMM, ManageEngine Endpoint Central) installed within a short window on the same host
- certutil.exe invoked with -urlcache -split -f arguments to download remote executables
- Web shell files (e.g., .php) created in XAMPP htdocs or IIS wwwroot directories via remote SMB admin share access
- GPO modifications creating scheduled tasks that enable BitLocker or deploy RMM software
- PowerShell WebClient DownloadFile or Net.WebClient calls downloading executables to Windows\Temp directory
- type command reading configuration files containing credentials (e.g., AWS rootkey.csv, Fortigate .conf) from network shares
- Windows legal notice / interactive logon message modified to display attacker messaging
False Positive Assessment
Medium - The attackers used legitimate Windows tools (BitLocker, GPO, manage-bde, certutil) and well-known RMM software, which may generate false positives in environments where these tools are used for legitimate administration. However, the specific patterns of multiple RMM tools installed rapidly, manage-bde recovery password collection outside IT contexts, and GPO-deployed BitLocker scheduled tasks are unusual enough to warrant investigation with moderate false positive risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider hunting for manage-bde.exe recovery password collection commands, multiple RMM tool installations, and GPO-deployed BitLocker scheduled tasks across your environment.
- If you have internet-exposed RDP or MSSQL services, consider immediately reviewing their exposure and enforcing MFA, network-level authentication, and access restrictions where supported by your infrastructure.
- Consider auditing for MSSQL instances with xp_cmdshell enabled and disabling it where not strictly required, as this extended stored procedure allows OS command execution from the database context.
- If your EDR or EPP supports it, consider searching for the specific RMM binaries (Mesh Agent, Tactical RMM, ManageEngine Endpoint Central) installed outside of approved deployment processes.
- Consider reviewing recent GPO changes for any scheduled tasks that enable BitLocker or deploy remote management software.
Infrastructure Hardening
- Evaluate whether RDP services need to be internet-exposed; consider placing them behind a VPN or zero-trust network access solution where supported by your architecture.
- Consider implementing strict application control policies to prevent unauthorized RMM tool installation, and baseline approved RMM tools in your environment.
- If applicable, consider enabling and enforcing BitLocker with centrally managed recovery keys (e.g., via Active Directory or Microsoft Entra ID) so that attackers cannot weaponize it against the organization.
- Consider reviewing GitHub and other code repositories for insecurely stored database credentials and rotate any exposed credentials.
- Evaluate whether your organization's GPO modification permissions are appropriately restricted, and consider monitoring GPO changes for suspicious policy deployments.
User Protection
- Consider ensuring EPP/EDR agents cannot be disabled due to application compatibility issues; where compatibility problems exist, evaluate application exclusions rather than full EPP disablement.
- If your EDR supports host isolation, consider preparing containment procedures for systems showing signs of mass BitLocker deployment via GPO.
- Consider implementing network segmentation to limit lateral movement from compromised database or web servers to domain controllers and shared storage.
- Evaluate whether corporate printers require network-level access controls to prevent unauthorized print jobs from being sent by compromised systems.
Security Awareness
- Consider incorporating guidance on the risks of storing credentials in code repositories into existing developer security awareness programs.
- Consider training IT staff to recognize the signs of BitLocker-based extortion, including unexpected drive encryption prompts and ransom notes printed via network printers.
- Consider reinforcing the importance of investigating security alerts promptly, as both incidents involved ignored or unaddressed EPP alerts that allowed attackers to operate undetected.
- Consider educating system administrators on the risks of disabling endpoint protection for application compatibility and the importance of finding alternative solutions.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Persistence
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- File Paths:
C:\Program Files\Mesh Agent\meshagent.exe- Mesh Agent RMM tool installed by attackers for persistent remote access to compromised systemsC:\Windows\Temp\python\py3.11.9_amd64\python.exe- Python 3.11.9 runtime deployed by attackers under Windows Temp to execute Tactical RMM deployment scripts\xampp\htdocs\<edited>\fingerprints\- Directory created by attackers on compromised web server to host web shell for command execution
- Command Lines:
- Purpose: Create web shell directory and .htaccess configuration on remote XAMPP server via SMB admin share | Tools:
cmd.exe,mkdir| Stage: Execution |mkdir \\<remote>\C$\xampp\htdocs\<path>\fingerprints - Purpose: Download malicious RMM agent binary from attacker-controlled Azure Blob Storage using certutil | Tools:
certutil.exe| Stage: Persistence - Purpose: Download malicious RMM agent binary using PowerShell WebClient | Tools:
powershell.exe| Stage: Persistence - Purpose: Collect BitLocker recovery passwords from encrypted drives to hold keys hostage | Tools:
manage-bde.exe| Stage: Impact |manage-bde -protectors -get C: -Type recoverypassword - Purpose: Execute Mesh Agent RMM tool with specific configuration flag | Tools:
meshagent.exe| Stage: Persistence |meshagent.exe -kvm1 - Purpose: Execute Tactical RMM deployment script via Python runtime installed in Windows Temp | Tools:
python.exe| Stage: Persistence |python.exe $appdata\TacticalRMM\<script>.py - Purpose: Read configuration files containing credentials from network shares (Fortigate config, SAP config, AWS root keys, Grandstream gateway config) | Tools:
cmd.exe,type| Stage: Credential Access |type "\\<remote>\soporte****\Documentos\Conf***\Amazon S3_rootkey.csv" - Purpose: Copy deployment batch script to remote system via SMB admin share | Tools:
cmd.exe| Stage: Lateral Movement |cmd /c echo copy /Y $temp\<file>.exe \\<remote>\C$\Windows\Temp\<file>.exe
- Purpose: Create web shell directory and .htaccess configuration on remote XAMPP server via SMB admin share | Tools:
- Other:
Trojan.Multi.Agent.gen- Kaspersky detection signature for malware identified during investigationTrojan.Win32.GenAutorunMsSqlServerCommandRun.a- Kaspersky detection signature for MSSQL command execution malwareTrojan.Win32.Generic- Kaspersky generic detection signature for trojan activityExploit.Win32.SCShell.a- Kaspersky detection signature for SCShell exploit tool