Here's yet more ransomware using BitLocker against Microsoft's own users

Kaspersky's researchers identified ShrinkLocker, a ransomware strain observed in Mexico, Indonesia, and Jordan that leverages VBScript and WMI to detect OS versions, resizes partitions and configures BitLocker on infected Windows systems, exfiltrates BitLocker recovery keys to an attacker-controlled server, deletes local recovery options and logs, then forces shutdown to present a ransom/BitLocker recovery screen; the report includes IOCs, detection tips, and mitigation recommendations such as restricting privileges, protecting recovery keys, logging execution events, and maintaining tested offline backups.