No Encryption Needed: New “GhostLock” Technique Weaponizes Windows SMB to Freeze Enterprise Files

GhostLock is a research-disclosed availability technique that abuses standard Windows CreateFileW semantics (share mode 0) to acquire exclusive SMB/NAS handles at scale, effectively locking legitimate users and applications out of files without writing, renaming, or encrypting data. The whitepaper demonstrates a fast, parallel proof-of-concept that can obtain hundreds of thousands of exclusive handles in minutes, evades behavioral ransomware defenses, and recommends surfacing storage-layer session telemetry and coordinated NAS response runbooks to detect and terminate rogue sessions.