A crew calling itself the XEntry Team is breaking into Latin American companies and turning Microsoft's own disk encryption against them, locking corporate drives with BitLocker and then delivering the ransom demand straight to victims' office printers. Researchers at Kaspersky's Global Research and Analysis Team documented two such intrusions, one in Colombia in June and one in Mexico in May, and warn that the tactic lets low-budget extortionists skip building ransomware entirely.
The approach is a form of "living off the land": rather than buying or coding an encryptor, the attackers simply switch on BitLocker, the full-disk encryption feature already shipped with Windows, and hold the recovery key hostage. Victims first notice a padlock icon next to their drives in Windows Explorer, then find they cannot log in. The ransoms were strikingly small by ransomware standards, with one demand set at just $3,000. Kaspersky notes this echoes an earlier BitLocker-abusing threat its team tracked as ShrinkLocker.
How the attacks worked
In the Colombian case, attackers reached an internet-exposed Remote Desktop (RDP) service on a machine attached to an 8 TB drive of financial data, manipulated user credentials, enabled BitLocker on that drive alone, and printed the ransom note on the company's own printers. Endpoint protection had been switched off on the system because of application compatibility issues, which made the intruders' work easier.
The Mexico incident, attributed to the XEntry Team, ran for roughly three months before discovery. The attackers got in through a misconfigured Microsoft SQL Server whose login credentials had been carelessly published in code on GitHub. The database was set up to allow operating-system commands through the xp_cmdshell stored procedure, giving the intruders a foothold to plant web shells, map the network, and steal configuration data for networking, management, and cloud services. They then deployed legitimate remote-management (RMM) tools, ManageEngine Endpoint Central, Mesh Agent, and Tactical RMM, to keep access and push scheduled tasks that enabled BitLocker and encrypted each system's disks with a unique key. A Group Policy Object finally spread the encryption from critical servers to every machine joined to the domain. Users saw a blue screen reading "Hacked by XEntry Team," and hours later ransom notes emerged from the printers.
Kaspersky assesses the two cases may be linked, pointing to similar phrasing in the notes (both invoke the gang's "reputation" as a payment guarantee) and the shared printer-and-BitLocker method. The behavior mirrors other recent Latin American intrusions, such as the wide-ranging campaign researchers uncovered in an advanced intrusion across Mexico, and it fits a broader trend of small, independent extortionists crowding in alongside the smaller ransomware brands filling the leak sites.
What you should do
Because these attacks lean on built-in Windows features and off-the-shelf admin tools, prevention is about configuration and monitoring rather than a single patch. Lock down or remove internet-facing RDP and MSSQL, disable xp_cmdshell where it is not needed, and never leave database credentials in public code repositories. Keep endpoint protection enabled even when an application misbehaves, centralize and actively triage security alerts (both companies received warnings that went uninvestigated), and watch for unexpected RMM installations, which Kaspersky says featured in more than one in five of the incidents it studied. Storing BitLocker recovery keys in a managed directory such as Active Directory also blunts the extortion leverage. Kaspersky detects components of the activity under names including Trojan.Win32.GenAutorunMsSqlServerCommandRun.a and Exploit.Win32.SCShell.a.
The researchers stress a practical lesson from the Colombian case: a rushed restore destroyed the forensic evidence, so preserve affected systems and follow a proper incident-response process before wiping anything. You can read the original write-up in Kaspersky's report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.