A newly observed extortion crew is encrypting victims' files using Windows' own built-in tools and announcing the attack through the office printer.

 

What happened

Researchers have documented two recent extortion incidents in which attackers locked down key drives using BitLocker, the disk encryption feature built into Windows, then sent their ransom notes to the victims' office printers, TechRadar reported on July 22, 2026. A group calling itself "XEntry Team" claimed both attacks, and no prior record of the name exists, making it either a genuinely new operation or a rebrand of an existing one. What connects the two cases is the entry method. Neither attack exploited a software vulnerability or tricked an employee with a deceptive message. The attackers simply walked in through misconfigured systems that were never locked down in the first place.

 

Going deeper

The first victim ran a machine holding eight terabytes of mission-critical data with its endpoint protection platform, the software that watches a computer for malicious activity, disabled over compatibility issues, and with Remote Desktop Protocol (RDP), the Windows feature that allows a computer to be controlled over a network, exposed directly to the internet. Access required little more than finding it. The second case shows more patience, three months before acting, the attackers found misconfigurations in the victim's Microsoft SQL database service that handed them privileged access, then spent the following weeks quietly lowering the server's security settings and planting web shells, small scripts hidden on a server that give an attacker ongoing remote control. Some of that activity triggered security alerts, and nobody investigated them thoroughly. Using BitLocker rather than custom ransomware carries a practical advantage for the attackers, since the encryption is performed by a trusted Windows component, leaving no malicious program for antivirus software to catch. The attackers asked for just $3,000, an offer the victim accepted quickly, which had the side effect of leaving too little forensic evidence behind for a thorough investigation.

 

What was said

"We strongly recommend configuring the RDP in strict accordance with cybersecurity best practices to prevent unauthorized access," the researchers warned in comments accompanying the findings, published July 22, 2026, noting that their incident data attributes more than 13% of cases to policy violations and configuration errors.

 

In the know

The $3,000 demand is small enough to be paid without lawyers or insurers getting involved, which is likely the point. Fast payment means investigators never get a clean look at the intrusion. Alerts fired during the months of preparation in the second case and nobody followed up, so the tooling worked and the process did not. The #StopRansomware Guide from CISA, the FBI, and the NSA already covers what would have stopped both attacks: audit the network for systems running RDP, close unused ports, enforce account lockouts, apply multifactor authentication, and log every login attempt.

 

The big picture

Misconfiguration ranks among the least glamorous causes of breaches and among the most persistent, and healthcare carries a heavy share of it, with aging systems, exposed remote access left over from vendor arrangements, and security tools disabled to keep clinical software running. Findings from Paubox's State of Email Security Report show 31.1% of breached healthcare organizations had multiple security gaps exposing them to major threats, a picture consistent with what the attackers in these two incidents found waiting for them. Regulators are moving in the same direction, since the proposed update to the HIPAA Security Rule would convert practices such as encryption, multifactor authentication, and network segmentation from flexible recommendations into requirements, precisely because so many incidents trace back to baseline hygiene rather than sophisticated attack techniques. An internet-exposed RDP port or a disabled endpoint agent costs nothing to fix compared with what these victims spent afterward, and no printer should ever be the first place an organization learns it has a problem.

 

FAQs

Can files encrypted with BitLocker by an attacker be recovered without paying?

Sometimes. If the organization retained its BitLocker recovery keys, stored in Active Directory, Microsoft Entra ID, or printed backups, recovery is straightforward. Attackers who set their own protectors and remove existing keys eliminate that path, which is why key escrow policies belong in every Windows environment before an incident, not after.

 

How should RDP be configured if remote access is genuinely needed?

Behind a virtual private network or remote access gateway rather than exposed to the open internet, restricted by firewall rules to known addresses, protected with multifactor authentication and account lockout policies, and logged centrally. Organizations that cannot meet those conditions should disable the service entirely.

 

What is the risk of disabling endpoint protection for software compatibility?

An unprotected machine becomes the softest target on the network, and attackers who gain any foothold actively search for such systems. When a compatibility conflict is unavoidable, compensating controls such as network isolation, application allowlisting, and enhanced logging should replace the disabled agent rather than leaving the gap open indefinitely.

 

Would an attack like this trigger HIPAA obligations if it hit a healthcare organization?

Almost certainly. Encryption of systems containing electronic protected health information by an unauthorized party is presumed to be a reportable breach unless a documented risk assessment demonstrates a low probability that the data was compromised, and a disabled security agent plus an exposed remote access port would draw regulatory attention to the organization's risk analysis.

 

Why do attackers send ransom notes to printers?

Printed notes guarantee visibility even when screens are locked or staff avoid the affected machines, and pages emerging from every office printer create an immediate, organization-wide alarm that pressures leadership to respond quickly. The technique dates back years but remains rare enough to generate exactly the attention extortionists want.