Researchers at Kaspersky Labs have discovered a new ransomware strain dubbed “ShrinkLocker” which uses Windows BitLocker to encrypt victim machines. The ransomware achieves this by creating a new boot partition through shrinking available non-boot partitions. ShrinkLocker is written in VBScript and runs a series of checks against the victim machine that it must pass before the ransomware continues with the attack. ShrinkLocker has targeted government entities and companies in the vaccine and manufacturing sectors. Unlike traditional ransomware, ShrinkLocker maximizes damage by detecting specific Windows versions and parameters before proceeding with encryption. It modifies registry entries to disable remote desktop connections and enables BitLocker on systems without a Trusted Platform Module (TPM). The malware uses the diskpart utility to shrink partitions, creates new primary volumes, and reinstalls boot files on these partitions, effectively locking users out. ShrinkLocker doesn’t leave a ransom note but provides a contact email as the label of the new boot partitions, making it easy to miss. After encryption, it deletes BitLocker protectors, leaving no recovery options. The ransomware operation appears to be more destructive than financially motivated, with multiple variants detected targeting entities in Mexico, Indonesia, and Jordan. Kaspersky recommends companies secure recovery keys, maintain offline backups, and use Endpoint Detection and Response (EDR) platforms to detect and prevent such attacks. CTIX analysts will continue to report on novel and interesting new malware threats.