Year: 2025
Type: conference-paper
Abstract: ShrinkLocker is a ransomware threat that abuses the native BitLocker utility to encrypt entire volumes, using advanced VBScript and PowerShell techniques to exfiltrate keys, disable key recovery, and perform drive-level encryption. In this paper, we provide a detailed technical analysis of the malware, review the adversary’s tactics, techniques and procedures (TTPs), and highlight key lessons learned from an incident response case. We also propose detection and mitigation strategies and emphasize the importance of behavioral-based monitoring over static signature detection in such advanced attacks.
Authors: Cristian H. M. Souza, Eduardo O. Chavarro
Institution: Universidade de São Paulo
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
OpenAlex ID: W4414125630