ctipilot.ch

XEntry Team

actor · actor:xentry-team single-source

Financially-motivated BitLocker-abuse extortion actor named from a May 2026 Mexico incident whose victims' screens displayed 'Hacked by XEntry Team' (Kaspersky GERT, 2026-07-21): initial access via a misconfigured Microsoft SQL Server (xp_cmdshell), persistence via legitimate RMM tools (ManageEngine Endpoint Central, Mesh Agent, Tactical RMM) and web shells, BitLocker deployed via GPO for encryption-for-impact, small ransom (~USD 3,000), ransom notes printed on office printers. Kaspersky documented a separate June 2026 Colombia BitLocker-extortion case (RDP-based) with which it assesses a POSSIBLE but unconfirmed link (ransom-note wording/delivery similarities; 'do not reveal a clear connection between the actors'). ShrinkLocker BitLocker-abuse lineage.

Coverage timeline
2
first 2026-07-22 → last 2026-07-26
Peak priority
notable
2 notable
Sources cited
6
5 hosts
Sections touched
2
active-threats, weekly-research
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
12
pinned v19.2 · see below
2026-07-222 appearances2026-07-26

Hunting pivots

ATT&CK techniques
T1486 ×2T1055.012T1071.001T1071.004T1090T1102.002T1133T1219T1484.001T1505.001T1505.003T1685
Affected products
ManageEngine Endpoint CentralMicrosoft SQL ServerMicrosoft Windows BitLockerTactical RMM
Tags
ransomware ×2cloudespionageidentityorganized-crime

ATT&CK techniques

12 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

Persistence TA0003

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

T1505.001Server Software Component: SQL Stored Procedures×1

Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

Privilege Escalation TA0004

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1484.001Domain or Tenant Policy Modification: Group Policy Modification×1

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

Stealth TA0005

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

Defense Impairment TA0112

T1484.001Domain or Tenant Policy Modification: Group Policy Modification×1

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1071.004Application Layer Protocol: DNS×1

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1090Proxy×1

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×2

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo · ATT&CK page ↗

Story timeline

  1. 2026-07-26This week's tradecraft converged on hiding command-and-control inside trusted services and native tooling — Graph-API calendars, DNS, the Telegram API, a browser the malware never connects through, and BitLocker instead of a ransomware binary
    weekly-researchUnrelated W30 disclosures share one move — routing C2 and impact through trusted services and native tooling, so process/domain-based detection stays blind
  2. 2026-07-22Kaspersky documents living-off-the-land BitLocker extortion across two Latin America incidents; the second self-identifies as 'XEntry Team'
    active-threatsBitLocker-for-impact extortion via exposed RDP, MSSQL and RMM/GPO — no encryptor ships, and one crew brands itself 'XEntry Team'

Where this entity is cited

  • active-threats1
  • weekly-research1

Source distribution

  • securelist.com2 (33%)
  • blog.talosintelligence.com1 (17%)
  • group-ib.com1 (17%)
  • proofpoint.com1 (17%)
  • zscaler.com1 (17%)

explore in graph

All cited sources (6)

Entries about XEntry Team (2)

2026-07-26 · view entry permalink →

NOTABLENATOA1

This week's tradecraft converged on hiding command-and-control inside trusted services and native tooling — Graph-API calendars, DNS, the Telegram API, a browser the malware never connects through, and BitLocker instead of a ransomware binary

Six unrelated pieces of 2026-W30 research, read together, describe one defensive problem more usefully than any single sample: attackers are increasingly routing both command-and-control and impact through infrastructure and tooling defenders already trust, so detection that keys on process reputation or destination novelty is blind to it. This extends the prior weekly's state-nexus "blinding the defender's own visibility" theme from EDR-evasion into a broader pattern — the trusted carrier is the point.

On the C2 side, the convergence is striking. Group-IB's HOLLOWGRAPH never contacts attacker infrastructure directly: it plants and reads tasking as attachments on far-future Microsoft 365 calendar events via the Graph API, and Kaspersky independently corroborated the same Cavern framework, adding a resilience layer in which — when Microsoft Graph authentication or tenant validation fails — the module recovers replacement connection settings (TenantId, ClientId, ClientSecret, UserEmail) via DNS AAAA responses from attacker nameservers (Kaspersky, 2026-07-21). Cisco Talos's msaRAT goes further and removes the socket from the malware entirely — "This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API" (Cisco Talos, 2026-07-23), driving a headless browser to tunnel over a WebRTC DataChannel relayed via a Twilio TURN server (with Cloudflare Workers handling the signalling), so endpoint tooling that asks "which process opened the connection" sees only the browser. Zscaler's TELESHIM, used against Middle-East government targets, "abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic" (Zscaler ThreatLabz, 2026-07-20).

The same "use what is trusted" logic runs through the endpoint and impact layers. Proofpoint's Cruciferra crypter-as-a-service — used by the China-nexus actor TA4922 to deliver AsyncRAT — combines a process-ghosting loader with BYOVD EDR termination and indirect syscalls issued from a clean on-disk copy of ntdll.dll, defeating user-mode hooks that monitor the loaded copy (Proofpoint, 2026-07-20). And Kaspersky's "XEntry" extortion cases skipped a bespoke ransomware family entirely, entering via internet-exposed RDP and a misconfigured SQL Server and then using legitimate RMM tooling and a Group Policy Object to deploy native BitLocker for encryption-for-impact (Kaspersky, 2026-07-21) — an impact stage with no malware artifact to signature at all.

This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API.

Cisco Talos 2026-07-23

TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.

Zscaler ThreatLabz 2026-07-20

Builds on: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-22/cavern-cav3rn-oilrig-attribution-dns-aaaa-c2-fallback · 2026-07-24/msarat-chaos-cdp-webrtc-covert-c2 · 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo

research26 Jul 23:43Zmulti-sourceOpen finding ↗
Sources: Group-IB Threat Intelligence · Kaspersky (Securelist / GReAT) · Cisco Talos · Zscaler ThreatLabz · Proofpoint Threat Insight · Kaspersky (Securelist / GERT)

2026-07-22 · view entry permalink →

NOTABLENATOB2

Kaspersky documents living-off-the-land BitLocker extortion across two Latin America incidents; the second self-identifies as 'XEntry Team'

Kaspersky's GERT incident-response team documented two 2026 extortion incidents in Latin America that abuse native Windows BitLocker for encryption-for-impact rather than deploying a conventional ransomware family — a living-off-the-land model that leaves no bespoke encryptor for signature-based detection (Kaspersky, 2026-07-21). In the first case (Colombia, June), initial access was an internet-exposed RDP service on a host attached to an 8 TB store of mission-critical data; after manipulating credentials the attacker enabled BitLocker on the drive and demanded roughly USD 3,000. In the second case (Mexico, May) — whose victims' screens displayed "Hacked by XEntry Team" — initial access was a misconfigured Microsoft SQL Server whose xp_cmdshell extended stored procedure allowed OS command execution; the operators established persistence through legitimate RMM suites (ManageEngine Endpoint Central, Mesh Agent, Tactical RMM) and web shells, then used Group Policy Objects to push BitLocker activation and encryption tasks across domain-joined systems. Both incidents delivered ransom notes through victims' office printers. Kaspersky notes similarities in the ransom-note wording and delivery method that may link the two cases but states the notes "do not reveal a clear connection between the actors" — so treat them as a shared technique cluster, with "XEntry Team" naming the Mexico intrusion specifically. Kaspersky places the approach in the ShrinkLocker BitLocker-abuse lineage, driven here by an RDP or MSSQL foothold and, in the branded case, an RMM-and-GPO admin workflow rather than a self-contained binary.

The attackers exploited an internet-exposed RDP service on a machine connected to an 8 TB storage device containing mission-critical data.

Finally, in mid-May, the attackers managed to execute a Group Policy Object (GPO) used to deploy activation and encryption tasks, as well as other policies responsible for continued deployment of RMM applications via scheduled tasks.

Although the ransom notes do not reveal a clear connection between the actors, certain words used in the messages, as well as the method of delivery and communication, may confirm a link

Kaspersky (Securelist / GERT) 2026-07-21
threat22 Jul 04:34Zsingle-sourceOpen finding ↗
Sources: Kaspersky (Securelist / GERT)