Troubling New Disk-Level Encryption Ransomware Surfaces

DeepBlueMagic also deletes Volume Shadow copy for Windows, making recovery all but impossible without a decryption key.

A new ransomware strain is implementing a troubling but so far relatively rarely used technique to encrypt data in a target environment.
Instead of encrypting files on endpoint systems like most ransomware families, the new malware, dubbed DeepBlueMagic, targets different disk drives on a target organizations servers, researchers from Heimdal Security say.
The malware was observed using a legitimate third-party encryption tool called BestCrypt Volume Encryption from Jetico to start encryption on all drives — except the primary system drive (“C:”) — on an infected Windows Server 2012 R2 system.
Heimdal found the encryption tool, along with a rescue file (rescue.rsc) that Jeticos software typically uses to recover damaged partitions, on the system drive of the infected machine. In this instance, however, the rescue file was encrypted as well and required a password to open it, according to Heimdals new report.
The security vendor was not able to determine how attackers might have gained initial access to the compromised system, nor was it able to obtain a sample of the original executable file because the ransomware deleted itself from the system.
Heimdals investigation showed that DeepBlueMagic had started the encryption process on the infected systems D: drive and almost immediately stopped the process after initiation. This resulted in the drive being partially encrypted and turned into a
RAW partition
— that is, basically, a partition where the file system structure has been corrupted and therefore not recognized by the system.
Any access attempt would have the Windows OS interface prompt the user to accept formatting the disk since the drive looks broken once encrypted,
Heimdal says in its report
. Usually, the rescue file that Jeticos encryption software uses could have been used to restore the partially encrypted drive, but in this case that was not possible because the rescue file had been encrypted as well.
As is the case with many ransomware strains these days, DeepBlueMagic is designed to disable any behavior-based threat detection tools that might be present on a targeted server — before the malware starts any encryption. Its approach for doing it is to stop all third-party Windows services on the system. Once the malware finishes encryption, it deletes the Windows Volume Shadow copy to make restoration impossible from encrypted drives. As a final flourish, the malware that Heimdal investigated leveraged its presence on a Windows server to try and activate Microsofts BitLocker encryption software on all endpoints in the victim organizations Active Directory.
Heimdal did not immediately respond to a Dark Reading request seeking clarification on why the attackers might have turned off the encryption almost immediately after initiating it and to other questions. The company says its malware analysts were able to restore files on the infected system using a freely available decryption tool from
CGSecurity.org
.
A Very Effective Tactic
Dirk Schrader, global vice president security research at Netwrix-owned New Net Technologies, describes the tactics used by DeepBlueMagic as adding a new wrinkle to ransomware attacks. File-based encryption has the tendency to be discovered during the process, especially when a larger number of files are to be encrypted, Schrader says. Encrypting the volume is a different, more versatile approach here as it can also easily span across RAID levels, being agnostic to the physical aspects of the RAID system.
The approach can help speed infection, especially considering DeepBlueMagics ability to stop all third-party services on a Windows machine, he says. Schrader says its possible that what Heimdal encountered was an early trial of a new approach. If seen as successful, it will be tuned and perfected to become more powerful, he warns.
Disk-level encryption is not new but is less frequently used than file-level encryptions, says Alec Alvarado, threat intelligence team lead at Digital Shadows. The approach is effective because the system itself is rendered almost useless and inaccessible. While many ransomware groups these days surgically pick and choose the files they want to encrypt, disk-level encryption removes access to everything on a system, he says.
Given the use of legit disk encryption software that is publicly available, the attackers may have taken this approach simply because it required less development effort, Alvarado says. He points to the Mamba ransomware group — an outfit thats been operating since at least 2016 — as using a similar disk-level encryption approach in attacks earlier this year. As with the operators of DeepBlueMagic, the Mamba group also used a publicly available encryption tool called DiskCryptor to encrypt data.
Disk-level encryption combined with the ability to delete shadow copies makes restoring an impacted system extremely difficult without the decryption key, Alvarado notes. In this particular case, it seems as if there is a decryption tool publicly available for the DeepBlueMagic ransomware.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Troubling New Disk-Level Encryption Ransomware Surfaces