GhostLock Attack Leverages Windows file-sharing to Lock Files Access Like Ransomware

GhostLock is a newly disclosed availability attack technique that abuses Windows SMB file locking (CreateFileW with dwShareMode = 0) to acquire exclusive handles on large numbers of files, making them inaccessible and producing the same operational impact as ransomware without encrypting data. Implemented as a low-privilege Python tool, it scales to hundreds of thousands of locked handles, evades common ransomware defenses and EDRs, and requires storage-operations intervention to recover; authors recommend exposing per-session exclusive-handle telemetry, SIEM ingestion, and joint SecOps/StorageOps runbooks.