ShrinkLocker
MITRE ATT&CK: S1178 View on attack.mitre.org
Aliases: ShrinkLocker
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 15:19:53
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
ShrinkLocker is a VBS-based malicious script that leverages the legitimate Bitlocker application to encrypt files on victim systems for ransom. ShrinkLocker functions by using Bitlocker to encrypt files, then renames impacted drives to the adversary’s contact email address to facilitate communication for the ransom payment.
Detection coverage
- 2 YARA rules
- 645 Sigma rules
Malware & tools used
- Internal Defacement (attack-pattern)
- System Information Discovery (attack-pattern)
- Visual Basic (attack-pattern)
- PowerShell (attack-pattern)
- Modify Registry (attack-pattern)
- Clear Windows Event Logs (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Web Service (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
- Disk Structure Wipe (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- System Shutdown/Reboot (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Disable or Modify System Firewall (attack-pattern)
- Execution Guardrails (attack-pattern)
- File Deletion (attack-pattern)
- Data Destruction (attack-pattern)
- Process Discovery (attack-pattern)
- Web Protocols (attack-pattern)
- System Time Discovery (attack-pattern)
Detection rules
- SEKOIA_Ransomware_Win_Shrinklocker (yara-rule)
- MALPEDIA_Win_Shrinklocker_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Shrinklocker (report)
- cybertriage.com — Wmi Malware (report)
- bitdefender.com — Shrinklocker Decryptor From Friend To Foe And Back Again (report)
- MITRE ATT&CK — S1178 (report)
- Kaspersky — 112643 (report)
- splunk.com — Shrinklocker Malware Abusing Bitlocker To Lock Your Data (report)