Organizations are facing an extortion workflow that feels both old and surprisingly efficient: attackers encrypt data with BitLocker, then use the company’s own printers to deliver ransom notes. In two incidents investigated in Latin America—one in Colombia and one in Mexico—teams observed a similar communication style, even though the technical paths into the environment differed.
This article summarizes what was seen, why the attacks worked, and which operational controls can reduce the risk. The focus keyword for this pattern is BitLocker extortion through printers.
How the first warning appears for users
In both reported cases, the first sign of trouble was visible in Windows: users noticed a padlock icon next to their drives in File Explorer. That indicator signaled that their storage was encrypted using BitLocker, which immediately blocked access to the contents.
To restore access, users needed a recovery key. For most organizations, the ability to obtain those keys quickly depends on internal processes, which makes the attackers’ timing a key part of the pressure tactic.
Case in Colombia: abusing RDP to encrypt critical storage
The Colombia incident started with a compromise of a machine exposed to the internet via RDP (Remote Desktop Protocol). That system was connected to an 8 TB storage device holding mission-critical information.
Once attackers gained control, they manipulated user credentials to enable encryption. Importantly, they activated BitLocker selectively—targeting the drive that primarily contained financial data rather than encrypting everything at once.
After encryption completed, the attackers locked the drive and then moved to extortion delivery. They used the organization’s printers to generate and distribute ransom notes.
Why investigators struggled to prove everything
In this case, evidence collection was limited because the company moved quickly to restore the encrypted disk. As a result, the forensic team could not capture enough artifacts to fully assess the intrusion.
From the attacker communication they reviewed, the ransom demand was reported as $3,000, and the organization considered paying. However, restoration happened before investigators could act, reducing the available data needed to confirm the full timeline.
What made the Colombia attack possible
The core enabler was internet-facing remote access combined with additional open ports and insufficient security controls. Employees used the RDP exposure to access corporate information—exactly the kind of convenience that becomes a risk when configuration and monitoring are weak.
The investigation also noted that endpoint protection (EPP) had been disabled on the system due to application compatibility issues. That created a better environment for attackers to validate and enumerate what they could execute, while central monitoring did not detect malicious behavior early enough.
More broadly, the report connects this type of outcome to the reality that misconfigurations and policy gaps continue to drive incident rates. If RDP ports remain open without appropriate restrictions, segmentation, and alerting, attackers can reach systems and data far more easily.
Case in Mexico: MSSQL misconfiguration and BitLocker deployment at scale
The Mexico incident followed a different initial access path, but the end goal matched the extortion pattern: attackers encrypted infrastructure drives with BitLocker and then triggered ransom notes through office printers.
In this case, the team identified that the threat actor leveraged a misconfigured MSSQL service to gain execution capabilities. They obtained database login credentials from code that had been published insecurely on GitHub.
Attack activity began approximately three months before detection. During that period, the intruder tested access, confirmed privilege levels inside MSSQL, and then expanded control beyond the database engine to the underlying operating system.
From database access to operating system commands
A key detail was the use of Microsoft SQL Server 2019. The server was misconfigured to allow operating system command execution via the xp_cmdshell extended stored procedure.
Because the MSSQL service was exposed to the internet, this misconfiguration effectively created a channel attackers could use to execute commands and interact with internal infrastructure within the scope of the compromised environment.
Building persistence with RMM and scheduled tasks
After establishing command execution locally, attackers started modifying web server settings and creating web shell files in publicly accessible locations. Some attempts were contained by existing endpoint protection controls, but alerts did not translate into the necessary investigation and remediation.
Next, attackers validated local command execution and set up infrastructure to transmit data using a communications bridge. From there, they used the compromised access to enumerate shared systems and resources that housed critical information, including configuration parameters for networking, enterprise management, and cloud services.
In early May, the activity shifted toward persistence and operational scaling: attackers ran additional scans and deployed ManageEngine Endpoint Central for remote monitoring and management (RMM). Later, they installed additional RMM-type tools, including Mesh Agent and Tactical RMM.
These tools were used to create scheduled tasks that enabled the BitLocker service and encrypted disks individually—generating a key for each encrypted system.
Domain-wide rollout: GPO and user impact
Mid-May marked a further escalation. Attackers executed a Group Policy Object (GPO) responsible for deploying activation and encryption tasks, alongside other policies that continued the delivery of RMM applications via scheduled tasks.
At first, the activity targeted critical systems, then spread to every system synchronized with the domain controller. Users became aware when machines displayed a blue screen message reading: “Hacked by XEntry Team”. At the same time, credentials stopped working to access systems.
Only a few hours later, ransom notes began appearing from office printers, completing the pressure loop that characterizes BitLocker extortion through printers.
Why these incidents matter
One of the most important takeaways from both cases is strategic: the attackers focused on getting access to infrastructure while avoiding direct investment in partnering with established ransomware groups. Instead, they used built-in Microsoft components and security-adjacent features to carry out encryption and drive ransom payments.
That means defenders cannot rely on simple “ransomware detection” thinking alone. The threat begins with access and misconfiguration, then leverages legitimate tooling in ways that can look less obvious until the encryption and user disruption happen.
What organizations should prioritize to reduce risk
Lock down RDP using security best practices
Strict configuration of Remote Desktop Protocol (RDP) is essential. The report strongly recommends aligning settings with cybersecurity best practices to prevent unauthorized access.
It also notes that a significant portion of incidents are linked to policy violations and configuration errors—reinforcing that “secure by configuration” is not optional.
Harden application control and monitor network traffic
Organizations should tighten application control policies and actively monitor network traffic for command-and-control (C2) behavior. In the reported environment, RMM tools played a major role in execution and C2 strategy, and attackers used multiple tools in a single intrusion.
When you can’t quickly verify what remote management software is doing, attackers can turn it into a delivery mechanism for scheduled tasks and system encryption.
Manage alerts and investigate quickly
In the Mexico case, existing endpoint protection produced alerts, but those signals did not lead to the investigation and containment required to stop the intrusion progression. This is a common failure point: alerts without follow-through can become part of the attacker’s timeline.
Operationally, this means centralizing logs for protected resources, promptly handling alerts, and ensuring incident response workflows are followed.
Preserve evidence during incident response
Some questions remained unanswered because the Colombia organization restored the disk quickly, bypassing key stages of the incident response process. If evidence is lost too early, defenders may struggle to confirm entry points, persistence mechanisms, and which accounts or services were used.
A clear incident response procedure—focused on preserving artifacts—helps you validate what happened and improve controls before the next attempt.
What we can learn from the ransom notes
Although the ransom notes did not reveal a definitive link between actors, the report highlights similarities in phrasing and delivery behavior. Both cases used the same “printer-driven” tactic to present demands directly into the organization.
Examples include statements like: “As a guarantee, we have no negative online reviews about non-fulfillment of our obligations…” and “Our reputation is the guarantee that all content will be fulfilled…”. That kind of language and messaging style can help incident analysts connect patterns across campaigns.
Bottom line: backups remain the strongest defense
Across ransomware events, one control consistently outperforms negotiation: strong, tested backups. Administrators and IT teams can make mistakes, antivirus can fail, and no environment is perfectly secure. Backups give you a practical path to restore data without paying for access.
Combined with hardened remote access (especially RDP), better alert handling, and strict controls around application execution and remote management, you can reduce the likelihood of BitLocker extortion through printers succeeding—or at least limit the impact if encryption occurs.
Source: https://securelist.com/new-extortion-scheme-printers-bitlocker/120718/
