An Iranian hackers collective, tracked as DEV-0270, has been exploiting the BitLocker Windows feature in cyberattacks to encrypt the victim’s systems. It has been found that this collective is operated by an Iranian company known under two names: Secnerd and Lifeweb.
Eventually, the hackers has been using the setup.bat commands to permit the BitLocker encryption, which makes the hosts out of service. And for the workstations, the collective uses DiskCryptor which is an open-source full disk encryption system for the Windows system. Consequently, it allows the encryption of a device’s entire hard drive.
Consequently, the threat intelligence experts have found that the collective can quickly abuse the newly exposed security vulnerabilities and living-off-the-land binaries (LOLBINs) in attacks.
Accordingly, the threat actor scans the internet to find the vulnerable servers and makes the organizations vulnerable to these attacks. The companies are now guided to patch their internet servers to block the abusive attempts and ransomware attacks.
