Loading story…
Attackers in Colombia and Mexico encrypted victim systems by abusing BitLocker, turning native Microsoft functionality into a low-cost extortion tool instead of deploying custom ransomware. In the Colombia case, intruders accessed an internet-exposed RDP service, changed user credentials, encrypted a critical 8 TB storage volume holding financial data, and demanded less than $3,000; the victim reportedly paid before forensic evidence could be preserved. Victims were alerted by locked drives, failed logins, and in some cases blue-screen messages reading "Hacked by XEntry Team."
In the Mexico intrusion, attackers exploited a misconfigured internet-facing Microsoft SQL Server using leaked MSSQL credentials exposed in GitHub code, then abused xp_cmdshell, remote monitoring and management tools including ManageEngine Endpoint Central, Mesh Agent, and Tactical RMM, and GPO-based task deployment to spread BitLocker encryption across domain-connected systems. Ransom notes were printed directly from corporate office printers, and researchers said weak configuration management, exposed remote services, poor monitoring of endpoint protections, and misuse of legitimate administration tools enabled both incidents; similarities in ransom-note wording and delivery suggest the operations may be linked, with one case attributed to XEntry Team.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In a May incident in Mexico, attackers used leaked MSSQL credentials found in code published on GitHub to access a misconfigured internet-exposed Microsoft SQL Server with xp_cmdshell enabled. They then expanded access, attempted web shell creation, used RMM tools, and deployed GPO-based tasks to spread BitLocker encryption across domain-connected systems.
In a June incident in Colombia, attackers accessed an internet-exposed RDP service, changed user credentials, and enabled BitLocker on a critical 8 TB storage volume containing financial data. They demanded a ransom of less than $3,000, which the victim paid before forensic evidence could be preserved.
Kaspersky Securelist published research on ShrinkLocker, describing ransomware abuse of Microsoft BitLocker. This established prior public reporting on BitLocker being turned into a ransomware mechanism.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers carried out two extortion intrusions in Latin America by abusing exposed Microsoft services and legitimate administration tools rather than deploying conventional ransomware. In one case in Colombia, a threat actor accessed an internet-facing `RDP` service, seized control of a system connected to an 8 TB storage device, encrypted the financial-data drive with **BitLocker**, and printed ransom notes demanding **$3,000**. In another case in Mexico, the group identified as **XEntry Team** exploited a misconfigured internet-facing **Microsoft SQL Server** with `xp_cmdshell` enabled after obtaining database credentials from code exposed on GitHub. After gaining access in Mexico, the attackers expanded through the environment by weakening web server security settings, deploying web shells, and installing remote management tools including **ManageEngine Endpoint Central**, **Mesh Agent**, and **Tactical RMM** for persistence and command execution. They then used **Group Policy Objects** and scheduled tasks to enable **BitLocker** and encrypt disks across the domain, while victims reported blue screens reading **"Hacked by XEntry Team,"** failed credentials, locked drives, and ransom notes printed from corporate printers. The incidents highlighted how exposed services, poor credential hygiene, weak alert handling, and ineffective endpoint protection can turn built-in Windows functionality into an enterprise-wide extortion mechanism.
Jul 21, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
Brazilian educational institutions faced a sustained wave of cyber incidents in incident-response cases reviewed from January 2025 through June 2026, with attackers most often gaining access through **valid accounts**, exploitation of public-facing applications, insider activity, and weak patch management. High-severity cases were dominated by ransomware, particularly **DragonForce** and **LockBit 3**, and private institutions were more frequently affected than public ones. Investigators also found that outdated and unpatched systems, including Windows 10 deployments kept past end of support and unpatched Windows Server 2016 hosts, materially increased exposure. Representative intrusions showed attackers relying on common but effective techniques rather than novel tradecraft. One LockBit case involved a custom deployment built from the leaked builder and spread with **PsExec**, aligning with the well-documented abuse of Windows **service execution** for lateral movement and payload launch. Another DragonForce intrusion used **AnyDesk** and log wiping to maintain access and hinder response, while a separate insider case involved a Python **keylogger** installed on a shared machine to capture credentials. The findings underscore the need for MFA, least privilege, removal of shared accounts, tighter control of remote-access tools, stronger backups, centralized logging, longer EDR retention, and faster patching.
Aug 3, 2026