Full Report
We cover two recent cases of BitLocker extortion using RDP, MSSQL, RMM tools, web shells, and printers. The story includes TTPs and recommendations.
Analysis Summary
# Tool/Technique: BitLocker Extortion via RDP & RMM
## Overview
This attack involves threat actors gaining unauthorized access to corporate networks to repurpose the legitimate Windows built-in encryption feature, **BitLocker**, for extortion. Unlike traditional ransomware, the attackers do not deploy custom encryption malware; instead, they use native system tools and Remote Monitoring and Management (RMM) software to lock drives and demand payment for the recovery keys.
## Technical Details
- **Type**: Technique / Living-off-the-Land (LotL)
- **Platform**: Windows (Server and Workstation)
- **Capabilities**: Full disk encryption, credential harvesting, remote persistence, and lateral movement.
- **First Seen**: Recent surge noted in 2024 (cases involving MSSQL and RDP).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1133 - External Remote Services (RDP)
- T1190 - Exploit Public-Facing Application (MSSQL, Web Shells)
- **TA0003 - Persistence**
- T1219 - Remote Access Software (Action1, ScreenConnect)
- T1505.003 - Server Software Component: Web Shell
- **TA0007 - Discovery**
- T1018 - Remote System Discovery
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Desktop Protocol
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact (via BitLocker)
## Functionality
### Core Capabilities
- **Native Encryption**: Utilizes `manage-bde.exe` to enable BitLocker encryption on local and network drives.
- **Remote Access**: Leverages compromised RDP credentials or exploits in MSSQL servers to gain a foothold.
- **Persistence via RMM**: Installation of legitimate RMM tools (e.g., Action1, ScreenConnect, Atera) to maintain access even if initial entry points are closed.
### Advanced Features
- **Printer Abuse**: In some cases, attackers send ransom notes directly to local printers to ensure visibility and create urgency.
- **Scripted Encryption**: Uses PowerShell scripts to automate the removal of existing protectors and the generation of new recovery passwords.
## Indicators of Compromise
- **File Names**:
- `sh.php`, `system.php` (Web shells)
- `action1_installer.msi` (Unauthorized RMM)
- **Network Indicators**:
- `185[.]225[.]74[.]221` (C2/Attacker IP)
- `91[.]149[.]253[.]66` (C2/Attacker IP)
- `action1[.]com` (Abused legitimate domain)
- **Behavioral Indicators**:
- Execution of `manage-bde.exe -on <Drive> -rp`
- Unexpected installation of RMM agents on servers.
- Large-scale drive encryption tasks initiated via PowerShell.
## Associated Threat Actors
- **Financially Motivated Actors**: Various unnamed groups applying "Ransomware-as-a-Service" (RaaS) style tactics without proprietary locker code.
## Detection Methods
- **Signature-based detection**: Identify known web shell signatures (e.g., PHP-based shells in web directories).
- **Behavioral detection**:
- Monitor for `manage-bde.exe` or `powershell.exe` commands containing BitLocker encryption strings.
- Alert on the creation of new administrative users or the unexpected addition of RMM software.
- **Event Logs**: Watch for Event ID 4624 (Successful Login) from unexpected external IPs and Event ID 4672 (Admin Logon).
## Mitigation Strategies
- **Multi-Factor Authentication (MFA)**: Enforce MFA for all RDP and VPN connections.
- **Least Privilege**: Secure MSSQL instances; ensure service accounts do not have OS-level administrative rights.
- **Software Restriction**: Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized RMM tools.
- **BitLocker Monitoring**: Implement alerts for changes to BitLocker status or the deletion of recovery protectors.
## Related Tools/Techniques
- **DiskCryptor**: Another legitimate tool often abused for similar extortion purposes.
- **Living-off-the-Land Binaries (LoLBins)**: General use of system utilities to bypass security controls.