Loading story…
Attackers carried out two extortion intrusions in Latin America by abusing exposed Microsoft services and legitimate administration tools rather than deploying conventional ransomware. In one case in Colombia, a threat actor accessed an internet-facing RDP service, seized control of a system connected to an 8 TB storage device, encrypted the financial-data drive with BitLocker, and printed ransom notes demanding $3,000. In another case in Mexico, the group identified as XEntry Team exploited a misconfigured internet-facing Microsoft SQL Server with xp_cmdshell enabled after obtaining database credentials from code exposed on GitHub.
After gaining access in Mexico, the attackers expanded through the environment by weakening web server security settings, deploying web shells, and installing remote management tools including ManageEngine Endpoint Central, Mesh Agent, and Tactical RMM for persistence and command execution. They then used Group Policy Objects and scheduled tasks to enable BitLocker and encrypt disks across the domain, while victims reported blue screens reading "Hacked by XEntry Team," failed credentials, locked drives, and ransom notes printed from corporate printers. The incidents highlighted how exposed services, poor credential hygiene, weak alert handling, and ineffective endpoint protection can turn built-in Windows functionality into an enterprise-wide extortion mechanism.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In the June 2021 Colombia incident, the attackers printed ransom notes demanding $3,000 after encrypting the victim's financial-data drive with BitLocker. The activity was part of a ransomware-style extortion scheme abusing legitimate Microsoft functionality.
In June 2021, attackers exploited an internet-exposed RDP service at a company in Colombia and took control of a machine connected to an 8 TB storage device. They encrypted the financial-data drive with BitLocker as part of an extortion attempt.
During the May 2021 Mexico intrusion, the attackers used GPO and scheduled tasks to enable BitLocker and encrypt disks across the domain. Victims observed locked drives, blue screens reading "Hacked by XEntry Team," failed credentials, and ransom notes printed from corporate printers.
In May 2021, attackers identified as XEntry Team exploited a misconfigured internet-facing Microsoft SQL Server with xp_cmdshell enabled after obtaining database credentials from code exposed on GitHub. They expanded access internally, lowered web server security settings, created web shells, and deployed remote management tools for persistence and command execution.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers in Colombia and Mexico encrypted victim systems by abusing **BitLocker**, turning native Microsoft functionality into a low-cost extortion tool instead of deploying custom ransomware. In the Colombia case, intruders accessed an internet-exposed **RDP** service, changed user credentials, encrypted a critical **8 TB** storage volume holding financial data, and demanded less than **$3,000**; the victim reportedly paid before forensic evidence could be preserved. Victims were alerted by locked drives, failed logins, and in some cases blue-screen messages reading **"Hacked by XEntry Team."** In the Mexico intrusion, attackers exploited a misconfigured internet-facing **Microsoft SQL Server** using leaked **MSSQL** credentials exposed in GitHub code, then abused `xp_cmdshell`, remote monitoring and management tools including **ManageEngine Endpoint Central**, **Mesh Agent**, and **Tactical RMM**, and **GPO**-based task deployment to spread BitLocker encryption across domain-connected systems. Ransom notes were printed directly from corporate office printers, and researchers said weak configuration management, exposed remote services, poor monitoring of endpoint protections, and misuse of legitimate administration tools enabled both incidents; similarities in ransom-note wording and delivery suggest the operations may be linked, with one case attributed to **XEntry Team**.
Jul 21, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026