Kaspersky recently documented a series of ransomware attacks targeting companies in Colombia and Mexico where attackers skipped the custom malware entirely and just weaponized BitLocker — Microsoft Windows’ legitimate disk encryption feature. The attacks succeeded because the evildoers understood something important: if you can get inside a network and activate BitLocker with your own recovery key, you don’t need ransomware. You’ve got the same result with a tool that’s already installed on every Windows system.
How the Attack Worked
In Colombia, the attackers gained access through an internet-exposed remote access service running on a server connected to 8TB of corporate data. Once inside, they changed user credentials, activated BitLocker on the drive containing financial records, and encrypted everything. Employees discovered the breach when they saw lock icons next to their drives in Windows Explorer and couldn’t access their files.
The Mexico incident involved a group calling themselves “XEntry Team.” They found SQL server credentials accidentally exposed in public source code, breached a misconfigured Microsoft SQL server, weakened the web server’s security settings, and maintained covert access for months. The attack surfaced when employees’ screens turned blue with “Hacked by XEntry Team” and their login credentials stopped working.
In both cases, the attackers printed ransom notes directly on office printers — a psychological pressure tactic that’s as effective as it is creepy.
Why Traditional Defenses Missed It
BitLocker is a legitimate administrative tool. It’s supposed to be there. Signature-based antivirus won’t flag it. Behavioral detection tools that look for “suspicious” encryption might catch it eventually, but by then the damage is done. The files are already encrypted.
The real problem is earlier in the attack chain: the initial access. The attackers had to land tooling on the compromised systems to maintain persistence, escalate privileges, and eventually activate BitLocker. That tooling — whether it’s a remote access trojan, a credential dumper, or a script — has to write files to disk.
How FileSure Would Have Blocked It
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file system operations before they complete. You define which programs are authorized to write executable files to the system. Everything else is blocked.
When the attacker’s initial payload attempts to land on disk — whether delivered via the compromised remote access service, the SQL server, or a web shell — FileSure intercepts the write operation. The payload isn’t authorized. The write is blocked. The file never lands.
No payload on disk means no persistence. No persistence means the attacker can’t maintain access long enough to activate BitLocker. The attack stops at the entry point.
Even if an attacker somehow bypassed that control and reached the BitLocker activation stage, FileSure’s threshold detection would catch the bulk encryption pattern. When BitLocker starts encrypting hundreds of files per minute, the threshold rule fires and blocks further write and rename operations. Damage is contained to whatever was modified before the threshold triggered — typically a handful of files, not the entire drive.
Here’s what a FileSure rule configuration for this scenario looks like:
File name filter: *.exe, *.dll, *.bat, *.ps1, *.vbs (block executable file writes)
Program name filter: Authorized deployment tools only (e.g., SCCM, approved installers)
Operations: Write, Create
Drive type: Hard drives, Network drives
Result: Unauthorized programs cannot write executable payloads to disk. The initial compromise is blocked before the attacker establishes a foothold.
And for bulk encryption detection:
File name filter: * (all files)
Operations: Write, Rename/Move
Drive type: Hard drives, Network drives
Threshold: 20 matches within 60 minutes
Result: Normal file operations pass without restriction. Mass encryption events cross the threshold within seconds and are blocked immediately.
FileSure works on legacy Windows systems that modern endpoint tools won’t touch — including the older servers running critical applications that can’t be easily replaced. If you’ve got systems you can’t upgrade and can’t afford to lose, FileSure protects those too.
Start your free 21-day trial at bystorm.com and see it block a simulated ransomware attack in under three minutes.
Category: Ransomware
Tags: bitlocker ransomware, xentry team, kernel filter driver, file system security, ransomware prevention, sql server attack, threshold detection, colombia mexico ransomware
