ShrinkLocker: Turning BitLocker into ransomware

This report analyzes a VBScript ransomware campaign that abuses Windows BitLocker to encrypt entire drives: the script resizes partitions, reinstalls boot files, removes BitLocker key protectors, generates a 64-character password seeded from system data, enables BitLocker with that password, exfiltrates machine and key data via POST requests (using Cloudflare tunnels), clears logs and tasks, and forces a reboot to present a BitLocker recovery screen. The analysis includes MITRE TTP mapping, IOCs (domains, e-mails, MD5), forensic findings, and mitigations.