On 21 July 2026 Kaspersky’s Securelist published an analysis of a new extortion scheme in Latin America in which attackers lock corporate drives with Windows’ own BitLocker and print the ransom note from office printers. The crew, which signs its work “XEntry Team”, asks for deliberately small ransoms and relies entirely on tools already inside the network rather than partnering with a ransomware group.
The ransom note did not arrive by email. It came out of the office printer, after Windows had already locked every drive with its own encryption.
On 21 July 2026 Kaspersky’s Securelist team described a new extortion scheme it investigated in Latin America, built almost entirely from tools that were already on the victims’ networks. Instead of deploying custom ransomware, the attackers turned on BitLocker, the full disk encryption feature built into Windows, to lock corporate drives, then demanded payment for the recovery key. Kaspersky analysed two incidents, one in Mexico in May 2026 and one in Colombia in June 2026, and found the same signature in both: a blue screen reading “Hacked by XEntry Team”, domain credentials that suddenly stopped working, and ransom notes that began printing from office printers a few hours later.
The attacker never brought their own ransomware
What makes this scheme notable is what is missing from it. There is no bespoke encryptor and no ransomware affiliate programme. The adversary uses BitLocker, Group Policy, remote access and remote management tools that already exist in a Windows domain, which keeps their toolkit cheap and hard to flag as malicious. The goal, as Kaspersky puts it, is to gain access and monetise it without ever investing in or partnering with a ransomware group.
What Kaspersky observed
The behaviour documented across the two Securelist incidents:
- Drives were encrypted with BitLocker; victims first noticed a padlock icon next to their drives in Windows Explorer and a prompt for a recovery key.
- Machines displayed a blue screen reading “Hacked by XEntry Team”, and domain credentials stopped working.
- A few hours later, ransom notes started printing from office printers across the organisation.
- The attackers abused legitimate mechanisms, RDP, MSSQL, remote management (RMM) tools and Group Policy, to spread encryption from critical systems to every machine synced with the domain controller.
- Ransom demands were kept deliberately small, part of an emerging trend Kaspersky highlights in the report.
The scheme in numbers
The figures describe the two incidents Kaspersky analysed in its 21 July 2026 Securelist report, not a global total. The report emphasises the pattern, tools already present in the environment and modest ransom amounts, rather than the scale of any single victim.
Why living-off-the-land extortion is hard to catch
The adversary’s objective is to gain access to infrastructure while avoiding investment in or partnership with ransomware groups, instead leveraging built-in Microsoft tools to facilitate data encryption and ransom payments.
How the attack unfolds
The two cases followed a similar arc, from a quiet foothold to a printer spitting out ransom notes. The sequence below is the one Kaspersky reconstructed, and it mirrors how a ransomware attack usually unfolds, with legitimate Windows features standing in for a dedicated encryptor.
The scheme at a glance
One campaign, no custom ransomware
Kaspersky Securelist, two incidents in Mexico and Colombia, May to June 2026
What each abused mechanism gave the attacker
The table maps each legitimate tool the crew abused to what it bought them, and to the control that closes the gap. None of these require new software, only tighter use of what Windows already ships.
| Legitimate mechanism | What it gave the attacker | Defensive control |
|---|---|---|
| BitLocker | Full disk encryption with no separate malware to detect | Escrow BitLocker recovery keys in Active Directory and alert on unexpected encryption events |
| RDP and MSSQL | Initial access and lateral movement through exposed services | Remove services from the internet, enforce MFA and monitor for unusual logons |
| RMM tools | Persistent remote control that blends in with IT operations | Allow only approved RMM software and alert on any other remote management agent |
| Group Policy | A way to push encryption tasks to every domain-joined host | Restrict who can edit GPOs and audit changes to Group Policy objects |
Where defences fail against this playbook
Because nothing here looks like classic malware, the usual assumptions are exactly what let it through. These are the failure modes the Kaspersky cases expose.
- ⛔ Trusting signature based antivirus, when the encryption is done by BitLocker, a signed Microsoft feature that no scanner will flag.
- ⛔ Leaving RDP and MSSQL reachable from the internet, which is how the foothold was won.
- ⛔ Treating every remote management agent as legitimate, when the attacker installs their own to blend in.
- ⛔ Failing to escrow BitLocker recovery keys, so a switched on drive becomes unrecoverable without paying.
- ⛔ Assuming a small ransom means a small problem, when the entire domain has already been encrypted.
A modest ransom is designed to make paying feel easier
Kaspersky notes a trend toward deliberately small ransom demands. A low figure is a tactic: it lowers the victim’s resistance and makes quiet payment look cheaper than recovery. Treat the decision the same way regardless of the amount, involve legal counsel and law enforcement, and remember that paying funds the next campaign and never guarantees a working key.
What to do this week
None of the following needs a new budget line. They close the specific paths this scheme uses, from exposed services to unmanaged encryption.
- ✅ Escrow every BitLocker recovery key in Active Directory or your MDM, and alert when encryption is enabled on a device that was not being provisioned.
- ✅ Take RDP and MSSQL off the public internet, put them behind a VPN or bastion and enforce multi factor authentication.
- ✅ Allowlist your remote management software so any unexpected RMM agent triggers an alert.
- ✅ Lock down who can edit Group Policy objects and audit every change to them.
- ✅ Keep at least one backup copy offline or immutable, beyond the reach of domain credentials.
- ✅ Rehearse recovery on the assumption that BitLocker has been turned against you, so keys and images are ready before you need them.
The cheapest ransomware is the one you already own
This scheme is a reminder that extortion no longer requires custom malware. When the encryptor is a built in Windows feature, prevention is mostly configuration and monitoring, not a new product. If you are responding to an active incident, preserve the printed ransom note and one encrypted drive before reimaging: it is the starting point for recovering encrypted files.
Sources
Juan Ricardo Palacio
Co-Founder and CEO for the Americas, HelpRansomware
Juan Ricardo Palacio is an electronic engineer, entrepreneur, and specialist in telecommunications, cybersecurity, and digital forensics, with more than 25 years of professional experience. As Co-Founder of HelpRansomware, he works across cyber resilience, ransomware incident response, data recovery, cryptography, and reverse engineering, supporting companies and organizations through high-impact cyber incidents.
📰 Featured and quoted in Forbes Georgia, Business Insider Africa, LA Weekly, and Il Sole 24 Ore.
📅 Last updated: 22 July 2026
