Colombia: ransomware using BitLocker

Kaspersky Security Services investigated a series of ransomware incidents in Colombia and Mexico between May and June 2026. In those cases, attackers combined misconfigurations, BitLocker encryption and the use of corporate printers to deliver ransom notes inside the organizations.

How did they get in and what did they do next?

In one of the cases analyzed in Colombia, initial access came through an internet-exposed remote access service. That service was tied to a server connected to an 8 TB storage device holding critical financial information. After gaining entry, the attackers changed user credentials, enabled BitLocker to encrypt the volume and used corporate printers to distribute the ransom notes.

Specialized coverage published in July also described a similar incident in Colombia, with the same entry point through exposed remote access and the subsequent encryption of a server linked to an 8 TB device containing information critical to business operations.

Who was the campaign attributed to and how did it operate?

According to the technical analysis cited by HelpRansomware from Securelist, the campaign in Colombia and Mexico was attributed to the actor known as XEntry Team. The group leaves a blue screen with the message "Hacked by XEntry Team" and, hours after encryption, prints ransom notes.

The same analysis says that in both incidents, Mexico in May and Colombia in June 2026, victims first noticed a lock icon next to the drives in Windows Explorer and a prompt asking for the BitLocker recovery key. That confirmed that no custom malware was deployed, only Windows' native encryption.

It was also detailed that the attackers abused legitimate mechanisms already present in the networks, such as RDP, MSSQL, remote management tools and Group Policy, to spread encryption from critical systems to the rest of the machines joined to the domain controller. The goal was to amplify the impact without needing ransomware binaries.

What regional reach did it have and what defenses are recommended?

TrendTIC reported in July 2026 on a campaign that affected organizations in Colombia and Mexico and noted that printing ransom demands is an emerging tactic in the region. HelpRansomware added that XEntry Team deliberately asks for small ransoms, in line with Kaspersky's observed trend of reduced amounts in these campaigns, something that can speed up payment and lower the public visibility of the incidents.

Carmona.mx said that in the Colombia and Mexico cases no exploits of specific vulnerabilities or targeted phishing campaigns were identified. The source of the intrusion was misconfiguration and poor management of internet-exposed services, which reinforced the importance of the exposed attack surface and weak hardening.

Among the technical recommendations drawn from the analysis are storing BitLocker recovery keys in Active Directory or MDM with alerts when encryption is triggered on unexpected devices, removing RDP and MSSQL from direct internet exposure and placing them behind a VPN or bastion with MFA, and limiting who can modify Group Policy objects while auditing every change.