Kaspersky’s latest incident analysis is a useful reminder that not every ransomware-style event needs custom malware. In two Latin American cases, intruders used exposed or misconfigured services, legitimate administration tools, Microsoft BitLocker, and even office printers to turn weak infrastructure hygiene into a ransom event.

The original research is worth reading directly: Kaspersky Securelist: A new extortion cocktail: office printers, small ransoms, and BitLocker.

What happened

The incidents followed a pattern defenders see constantly: attackers did not need a flashy exploit chain when remote access and service configuration gave them a path in. In one case, an internet-facing RDP service exposed a machine attached to critical storage. The attacker took control of the system, enabled BitLocker on a drive containing financial data, locked the volume, and used company printers to deliver the ransom note.

In the second case, the attacker reportedly abused a misconfigured Microsoft SQL Server exposed enough to allow operating system command execution. Credentials had been left in code published to GitHub, and the SQL Server configuration allowed xp_cmdshell-style command execution against the host. From there, the intrusion expanded into web shell activity, remote monitoring and management tooling, scheduled tasks, Group Policy abuse, and BitLocker encryption across additional systems.

Why it matters

This is the kind of attack path that should worry small businesses, local governments, and government contractors because it sits in the gap between “we have security tools” and “we actually respond to the alerts.” The tools involved were familiar: RDP, MSSQL, RMM utilities, scheduled tasks, Group Policy, printers, and BitLocker. That makes the activity easy to underestimate until the encryption event is already underway.

The ransom amounts described were also relatively small compared with major ransomware cases. That matters because lower demands can make payment feel cheaper than proper investigation. For defenders, that is a trap. Restoring too quickly without evidence preservation can erase the only path to understanding initial access, scope, credential exposure, and whether persistence remains.

Defensive takeaways

  • Remove direct RDP exposure. Put remote access behind VPN, zero-trust access, strong MFA, conditional access, and logging. If RDP must exist internally, restrict it by group, host, and source network.
  • Audit internet-facing SQL services. MSSQL should not be casually reachable from the internet. Disable dangerous features such as OS command execution unless there is a documented, monitored, and time-bound business requirement.
  • Hunt for secrets in code. GitHub, GitLab, Bitbucket, and old deployment repos should be scanned for database credentials, service passwords, API keys, and connection strings.
  • Treat RMM installation as high-signal. ManageEngine Endpoint Central, Mesh Agent, Tactical RMM, AnyDesk, ScreenConnect, Atera, Splashtop, and similar tools need allowlisting, inventory, and alerting when newly installed or launched from unusual hosts.
  • Monitor BitLocker administration at scale. Alert on sudden BitLocker enablement, recovery key export, suspicious use of manage-bde, encryption operations pushed through scheduled tasks, and BitLocker activity initiated by unexpected accounts.
  • Preserve evidence before restoring. Capture disk, memory where practical, event logs, RMM logs, firewall logs, VPN logs, SQL logs, domain controller events, and EDR telemetry before wiping systems.

Bulwark Black assessment

This campaign is not just a ransomware story. It is a misconfiguration story, an identity story, and an operations story. The attacker’s advantage came from normal administrative paths being left exposed, over-permissioned, or under-monitored.

For SMBs and government contractors, the proper defensive move is not only buying another endpoint product. The real control stack is service exposure management, credential hygiene, administrative tool governance, centralized logging, and rehearsed incident response. If a single exposed RDP host or misconfigured SQL server can encrypt business-critical data, the environment is not resilient yet.

The practical question for defenders this week is simple: could your team detect and stop unauthorized BitLocker enablement, new RMM deployment, or SQL-driven OS command execution before users see locked drives and printed ransom notes?